U.S. Department of Justice 


Executive Office for United States Attorneys 
Freedom of Information Act & Privacy Act Staff 


Bicentennial Building (202) 252-6020 
600 E Street, NW, Suite 7300 (202) 252-6047 Fax 
Washington, DC 20530 


May 12, 2017 


John Greenewald, Jr. 
The Black Vault 


john@greenwald.com 


Re: Request Number: EOUSA-2017-001076 
Date of Receipt: April 5, 2017 
Subject of Request: Petraeus Investigation — Records Pertaining to Civil Action No. 16-cv-00514 


Dear John Greenewald, Jr., 


Your Freedom of Information Act/Privacy Act request for records released in the above- 
referenced action has been processed. This letter constitutes a reply from the Executive Office 
for United States Attorneys, the official record-keeper for all records located in this office and 
the various United States Attorneys’ Office. 


To provide you with the greatest degree of access authorized by the Freedom of 
Information Act and the Privacy Act, we have considered your request in light of the provisions 
of both statutes. 


The records you seek are located in a Privacy Act system of records that, in accordance 
with regulations promulgated by the Attorney General, is exempt from the access provisions of 
the Privacy Act. 28 CFR § 16.81. We are making available to you documents that have been 
released in a previous FOIA request. 


The exemption(s) cited for withholding records or portions of records are marked 
below. An enclosure to this letter explains the exemptions in more detail. 


List of Exemptions: 


For your convenience, we are also providing you with a direct link to the location of the 
recently unsealed search warrants located on the U.S. Attorney for the Western District of North 


Carolina’s website. The link to the website is: http://www.ncwd.uscourts.gov/news/documents- 
released-general-petraeus. 


This is the final action on this above-numbered request. If you are not satisfied with my 
response to this request, you may administratively appeal by writing to the Director, Office of 
Information Policy (OIP), United States Department of Justice, Suite 11050, 1425 New York 
Avenue, NW, Washington, DC 20530-0001, or you may submit an appeal through OIP's 
FOIAonline portal by creating an account on the following website: 
https://foiaonline.regulations.gov/foia/action/public/home. Your appeal must be postmarked or 
electronically transmitted within ninety (90) days of the date of my response to your request. If 
you submit your appeal by mail, both the letter and the envelope should be clearly marked 
“Freedom of Information Act Appeal.” 


You may contact our FOIA Public Liaison at the telephone number listed above for any 
further assistance and to discuss any aspect of your request. Additionally, you may contact the 
Office of Government Information Services (OGIS) at the National Archives and Records 
Administration to inquire about the FOIA mediation services they offer. The contact information 
for OGIS is as follows: Office of Government Information Services, National Archives and 
Records Administration, 8601 Adelphi Road-OGIS, College Park, Maryland 20740-6001; e-mail 
at ogis@nara.gov; telephone at 202-741-5770; toll free at 1-877-684-6448; or facsimile at 
202-741-5769. 


Enclosure(s) 


Sincerely, 
oS ee 


Kevin Krebs 
Assistant Director 
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FILED 


UNITED STATES DISTRICT COURT FOR THE , 


WESTERN DISTRICT OF NORTH CAROLINA DEC 20 2016 
CHARLOTTE DIVISION 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-1 Gvesten Dances ‘ 
v. MOTION TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF AND APPLICATION 


DESCRIBED IN AFFIDAVIT AND 
ATTACHMENTS, INCORPORATED 


) 
) 
) 
CONTENT OF EMAIL ACCOUNT AS : 
) 
HEREIN. ) 


NOW COMES the United States of America, by and through Jill Westmoreland Rose, 
United States Attorney for the Western District of North Carolina, who respectfully shows unto 
the Court that on April 4, 2013, the court issued a search warrant in the above-captioned case and 
placed under seal the warrant, the application for the warrant and the affidavit in support of the 
application for the warrant; after reviewing the materials in connection with pending Freedom of 
Information Acct litigation in the United States District Court for the District of Columbia, the 
United States now seeks to unseal said documents, subject to redactions of personal identifying 
information, pursuant to Local Criminal Rule 49(B) of this Court (the search warrant materials, 
as redacted by the government, are attached hereto). 

THEREFORE, the United States respectfully moves the Court for the search warrant, the 
application for the warrant, and the affidavit in support of the application for the warrant listed 
above be unsealed. 

Respectfully submitted, on this day of December 19, 2016. 


JILL WESTMORELAND ROSE 
UNITED STATES ATTORNEY 


/Is/ITILL WESTMORELAND ROSE 


ASSISTANT UNITED STATES ATTORNEY 
NC Bar Number # 17656 
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Attorney for USA 
Carillon Bldg, Suite 1700 
227 West Trade Street 
Charlotte, NC 28202 
Phone: 704-344-6222 
Fax: 704-344-6629 


Email: jill.rose@usdoj.gov 
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UNITED STATES DISTRICT COURT FOR THE 


WESTERN DISTRICT OF NORTH CAROLINA 


CHARLOTTE DIVISION 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-100 
v. ORDER TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF AND APPLICATION 


DESCRIBED IN AFFIDAVIT AND 
ATTACHMENTS, INCORPORATED 


) 
) 
) 
CONTENT OF EMAIL ACCOUNT, AS 
) 
HEREIN. ) 


UPON MOTION of the United States of America, by and through Jill Westmoreland 
Rose, United States Attorney for the Western District of North Carolina, it appearing that on 
April 4, 2013, the Court issued a search warrant in the above-captioned case and placed under 
seal the warrant, the application for the warrant, and the affidavit in support of the application for 
the warrant; it further appearing that the government, after reviewing the materials in connection 

_ with pending Freedom of Information Act litigation in the United States Court for the District of 

Columbia, now seeks to unseal said documents, subject to redactions of personal identifying 
information, pursuant to Local Criminal Rule 49(B) of this Court (the search warrant materials, 
as redacted by the government are attached hereto), it is hereby 

ORDERED that the search warrant, application for search warrant, and affidavit in 
support of the application for the search warrant, as redacted by the government, are hereby 
UNSEALED. 

The Clerk is directed to certify copies of this Order to the United States Attorney's 
Office. 


This the a Oday of December, 2016. 


aeana 
UNITED STATES Gn eee 
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+ 


—____ A093 (Rev 12/09} Search _and-Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
Western District of North Carolina Cortified fo ke a ty 
In the Matter of the Search of ) 
(Briefly describe the property to be searched ) : 
or identify the person by name and address) ) Case No. 3 ‘I 3 m | {o 0 
Content of email account, as described in Affidavit and ; 
Attachments, incorporated herein. ) 


SEARCH AND SEIZURE WARRANT 
To: Any authorized Jaw enforcement officer 


; An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Western District of North Carolina 


(identify the person or describe the property to be searched and give its location): 
See Attachment A, which is incorporated fully herein. 


The person or property to be searched, described above, is believed to conceal (identify the person or describe the 
property to be seized): s 
See Attachment B, which is incorporated fully herein. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 


property. 
YOU ARE COMMANDED to execute this warrant on or before April 17, 2013 
° (not to exceed 14 days) 
O inthe daytime 6:00 a.m. to 10 p.m. & at any time in the day or night as I find reasonable cause has been 


established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge 
Robert J. Conrad, Jr. 


(name) 


O I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be 
searched or seized (check the appropriate box) (© for days (not to exceed 30). 


O until, the facts justifying, the later specific date of 


Date and time issued: YW. 3 Pan i 4, 5:30 p: Ls mes 


City and state: Charlotte, North Carolina Robert J. Conrad, U.S. District Court Judge 
Printed name and title 


Judge's signature 
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Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


I declare under penalty of perjury that this inventory is correct and was returned along with the original 
warrant to the designated judge. 


Executing officer's signature 


Printed name and title 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT 


for the 
Wester District of North Carolina FI LED 
CHARLOTTE, NC 
: In the Matter of the Search of ) APR 4 

Bi describe th 5 hed . . 

la anlar oy case No. 4113447 100 an 

Content of email account, as described in Affidavit and ; Us District c: 
: Ourt 
Attachments, incorporated herein. stern Distri ict of NC 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attomney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


I 
Pree ont en bs merit and ge of YF Fe Ratt ated fully herein, 


| located in the Western District of North Carolina , there is now concealed (identify the 
person or describe the property to be seized): 
See Attachment B, which is incorporated fully herein. Certified te baa true and 
; correct copy of the original, 
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): : “US. trict Couit 
® evidence of a crime: me 3. Jobns, Clark 
wf contraband, fruits of crime, or other items illegally possessed; tem District of us 6. 
CG property designed for use, intended for use, or used in committing a crime; By. om 
0 a person to be arrested or a person who is unlawfully restrained. oY ¢/r 9! 
The search is related to a violation of: 
Code Section Offense Description 
18 USC 1924; 18 USC 793(e); Unauthorized removal and retention of classified documents or material; 
18 USC 371 Unauthorized possession, communication, and willful retention of national defense 


information; Conspiracy 


The application is based on these facts: 


a Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Applicant's Signature 


Gerd J. Ballner, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


Date: 04/03/2013 OAL “fe 


City and state: Charlotte, North Carolina Robert J. Conrad, Jr., United States District Court Judge 
Printed name and title 


Judge’s signature 
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AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT. 


I, Gerd J, Ballner, Jr., being first duly sworn, hereby depose and state as follows: 


INTRODUCTION AND AGENT BACKGROUND 


1. [make this affidavit in support of an application for a search warrant for information 


associated with a certain account stored at premises owned, maintained, controlled, or 


operated by Yahoo! Inc., an email provider headquartered at 701 First Avenue, 
Sunnyvale, California 94089. The information to be searched is described in the 


following paragraphs and in Attachment A, all incorporated fully by reference herein. 


2. Tama Special Agent with the Federal Bureau of Investigation (FBI) and have been tod 
employed as such for approximately thirteen years. I have investigated matters involving i 
National Security to include Counterintelligence and Espionage. I am currently assigned 
to the Charlotte, North Carolina FBI office. Through investigations, experience, and 
training, I have become familiar with methods and operations employed by hostile 
foreign intelligence services and their recruited human sources to illegally oat oes 
clandestine action, classified and proprietary information, which if compromised poses 
risk to the national security of the United States. I have also received specialized training 


inhe proper collection, retention, and dissemination of classified information. 


3. The facts in this affidavit come from my personal observations, my training and 


experience, evidentiary review, and information obtained from other Agents, government 
officials, and witnesses. This affidavit is intended to show merely that there is sufficient 
probable cause for the requested warrant and does not set forth all of my knowledge 


about this matter. 
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STATUTORY AUTHORITY ! 

4. The FBI has been conducting an investigation of| SSS for possible 

violations of: (a) unauthorized removal and retention of classified documents and 

material, in violation of Title 18, United States Code, Section 1924; (b) unauthorized | 

possession and, inter alia, attempted communication and willful communication of 

national defense information to someone not entitled to receive it, as well as the willful 

retention of national defense information, in violation of Title 18, United States Code, 

Section 793(e); and (c) conspiracy to commit the aforementioned crimes, in violation of 

Title 18, United States Code, Section 371. . 
5. For the reasons set forth below, there is probable cause to believe that the email account 


Baza (described in detail in Attachment A) contains evidence, i 


fruits, and/or instrumentalities of violations of federal law, including, inter alia, the 


improper communication and/or retention of classified information. 
6. Title 18, United States Code, Section 1924(a) states: 


Whoever, being an officer, employee, contractor, or consultant of the United 
States, and, by virtue of his office, employment, position, or contract, becomes 
possessed of documents or materials containing classified information of the 
United States, knowingly removes such documents or materials without authority 
and with the intent to retain such documents or materials at an unauthorized 
location shall be fined under this title or imprisoned for not more than one year, or 
both. : 


18 U.S.C. § 1924(a). 
7. Title 18, United States Code, Section 793(e) states: 


Whoever having unauthorized possession of, access to, or control over any 
document, writing, code book, signal book, sketch, photograph, photographic ; 
negative, blueprint plan, map, model, instrument, appliance, or note relating to the 
national defense, or information relating to the national defense which- 

information the possessor has reason to believe could be used to the injury of the 

United States or to the advantage of any foreign nation, willfully communicates, 
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10. 


delivers, transmits or causes to be communicated, delivered, or transmitted, or 
attempts to communicate, deliver, transmit or cause to be communicated, 
delivered, or transmitted the same to any person not entitled to receive it, or 
willfully retains the same and fails to deliver it to the officer or employee of the 
United States entitled to receive it . . . shall be fined under this title or imprisoned 
not more than ten years or both. 
18 U.S.C. § 793(e). 
Title 18, United States Code, Section 371, makes punishable, by up to five years in 
prison, a conspiracy among two or more persons to commit any offense against the 
United States. . 
Classified information is defined by Executive Order 13526 (E.O. 13526) and relevant 
preceding Executive Orders, as information in any form that: (1) is owned by, produced 
by or for, or under the control of the United States government; (2) falls within one or 
more of the categories set forth in the E.O. 13526; and (3) is classified by an original 
classification authority who determines that its unauthorized disclosure reasonably could 
be expected to result in damage to the national security. Where such unauthorized 
disclosure reasonably could be expected to cause “damage” to the national security, the 
information is classified as “Confidential.” Where such unauthorized disclosure 
reasonably could be expected to cause “serious damage” to the national security, the 
information is classified as “Secret.” Where such unauthorized disclosure reasonably 
could be expected to cause “exceptionally grave damage” to the national security, the 
information is classified as “Top Secret.” 
Pursuant to E.O. 13526, a person may only gain access to classified information if a 
favorable determination of eligibility for access has been made by an agency head or an 


agency head’s designee, the person has signed an approved nondisclosure agreement, and 


the person has a need-to-know the information. 
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PROBABLE CAUSE 

11. David Petraeus is a retired United States Army General. From on or about October 31, 
2008 to June 30, 2010, PETRAEUS served as Commander of the United States Central 
Command. From on or about July 4, 2010 to July 18, 2011, Petraeus served as 
Commander of the International Security Assistance Force. From on or about September 
6, 2011 to November 9, 2012, Petraeus served as Director of the Central Intelligence 
Agency (CIA). At all times relevant to this affidavit, Petraeus held a United States 
government security clearance allowing him access to classified United States 
government information. According to a Department of Defense (DOD) official, to 
obtain that clearance, Petraeus was required to and would have agreed to properly protect 
classified information by not disclosing such information to persons not entitled to 
receive it, by not unlawfully removing classified information from authorized storage 
facilities, and by not storing classified information in unauthorized locations, 

12. i is a researcher and author of a biography of Petraeus, published in 
January 2012. From on or about July 18, 2003 until on or about November 14, 2012, 
HR tel 2 United States government security clearance allowing her access 
to classified United States government information. According to a DOD official, to 
obtain that clearance, ————3} was required to and would have agreed to properly 
protect classified information by not disclosing such information to persons not entitled 
to receive it, by not unlawfully removing classified information from authorized storage 
facilities, and by not storing classified information in unauthorized locations. 

13. In June 2012, the FBI’s Tampa Division (FBI Tampa) opened a computer intrusion 


investigation related to alleged cyber stalking activity. This investigation was predicated 


4 
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on a complaint received from Witness 1, which alleged the receipt of threatening and 
harassing emails from the email addresses i and 

ee = | Witness 1 claimed friendships with several high-ranking 
public and military officials. 

14. Evidence gathered during the FBI Tampa investigation indicated that someone had access 
to the personal schedule of David Petraeus, who was then the Director of the CIA. This 
access indicated a potential breach of security. On or about June 22, 2012, FBI 
Headquarters (FBIHQ) notified Petraeus’s security detail of the ongoing computer 
intrusion investigation and the potential security issue. On July 19, 2012, FBI Tampa 
was notified by Witness | that he/she no longer wished to press charges against the cyber 
stalker. On August 10, 2012, Witness 1 informed FBI Tampa that Petraeus personally 
requested that Witness 1 withdraw his/her complaint and “call off the G-men.” On 
August 13, 2012, Witness 1 advised FBI Tampa that Petraeus believed the alleged cyber 
stalker possessed information which could “embarrass” Petraeus and other public 


officials. 


‘15. Investigation conducted by FBI Tampa identified  — as the person 


suspected of using the email accounts Jin and 
HE. vestigation also determined ME uses the email 
account i On September 24, 2012, FBI Tampa interviewed 


a. at her residence. During this interview == admitted sending 


the emails to Witness 1, as well as other emajls regarding Witness 1 to senior United 


States military officers as well as a foreign diplomat. ——ee also stated that she 
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16 


“17. 


engaged in an extramarital affair with Petraeus. I provided consent to 


search two of her laptop computers and two external hard drives. 


. On September 25, 2012, FBI Tampa returned i laptop computers and 


conducted a follow-up interview. During this follow-up interview, sa : 

admitted she told Petraeus that he should get Witness 1 to “drop the charges.” 
HE advised she does not know if Petraeus made the request of Witness L 
During the course of this interview, HR provided interviewing agents consent 
to search her Apple iPhone, which she had in her possession. FBI Charlotte Computer 
Analysis Response Team (CART) Forensic Examiners copied the contents of her Apple 
iPhone at the interview location, and the iPhone was returned to ae: the 
conclusion of the interview. A review of RN laptops and extemal hard 
drives located over 100 items which were identified by Charlotte CART Forensic 
Examiners as containing potentially classified information, including information up to 
the Secret level. 
On October 26, 2012, Petraeus was interviewed at CIA Headquarters. Petraeus stated 
that he had had an extramarital affair with MMMM. He denied providing any 
classified documents ii. or having any arrangement to provide her with 
classified information. Petraeus stated that may have obtained 
documents in the.course of conducting research for a book she was writing. He explained 
that reporters in theater (Afghanistan), such as NN, were sometimes granted 
“off-the-record” access to classified presentations, such as the COMISAF’s (Commander, 


International Security Assistance Force) daily briefings. 


6 
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18. On November 2, 2012, FBI Tampa interviewed EEE in Charlotte, North 
Carolina regarding the potentially classified documents found on her computers. She 
claimed she came into possession of several of the documents when she was in 
Afghanistan researching her book about Petraeus; however, she was unable to provide 
specifics as to how she obtained them. Eze stated that during her time in 
Afghanistan she was given access to several briefings, including at least one briefing at 
the Secret level. [c= = =- advised that reporters were often given such access in 
order to provide them with situational awareness of the war. In order to receive the 
briefings, MM. signed an “off-the-record” agreement, which meant she could 
not write about classified information she observed. She stated she would sometimes 
obtain a paper copy of the briefings to preserve the information as research for her book. 
aaa. Pee that she never received classified information from Petraeus. 

19. During interviews conducted of [EM and Petraeus under the aforementioned 
FBI Tampa investigation, each advised they used covert methods to communicate with 
one another. These methods included the use of pre-paid cellular telephones and email 
accounts using non-attributable names. Several of these covert email accounts were . 
identified during the FBI Tampa investigation; however, it is not known if all the 
accounts were identified because both A ecd Petraeus stated they could not 
recall all the account names which they created and used to communicate. During 

, i — — si] September 25, 2012 interview, she advised that she and Petraeus would 
sometimes share the same account, and would save messages to the draft folder instead of 


sending them via email. 
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A. MS Consensual Search, November 12, 2012 
20. As a result of finding potentially classified information on the laptops provided by 
HS, FB Tampa and FBI Charlotte conducted a consensual search of 
MEE Charlotte residence on November 12, 2012 to recover arty evidence 
related to cyber stalking, in violation of 18 U.S.C. § 2261A, and the unauthorized 
removal and retention of classified documents or material, in violation of 18 U.S.C. 
§ 1924. On this same date, a consensual search was also conducted at the residence of 
MES administrative assistant, SE in Concord, North 
Carolina. BE vo wnterily provided the FBI with various items she maintained in 
jean in relation to her employment with i. During the searches, 
additional paper documents were found, some of which, upon belief and information of 
your affiant, are classified. Asa ‘aa of the two searches, the following digital media 
were seized: eight computers, twelve external hard drives, two printers/scanners, two 
cellular telephones, two Apple iPods, seven thumbdrives/memory cards, and 
. approximately fifty floppy discs, CDs, and optical discs. 

21. Based on a preliminary review of MEE digital media, it is believed she came 
into possession of potentially classified information both before and during the writing of 
her book, “All In: The Education of General David Petraeus.” Of the potentially 
classified documents reviewed to date, the majority relate to U.S. military operations 
conducted in Afghanistan. Given her extensive use of digital media, your affiant believes 

MR eceived/exchanged classified information via email and/or made contact 
with individuals via email and/or telephone to schedule in-person meetings for the 


purpose of recording and collecting classified information, as detailed below. 
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| is also believed to have digitally stored numerous documents, 
photographs, and audio interviews which contain classified information. 


B. Relevant Communications Regarding the Potential Mishandling of Classified 
Information 


22. On May 12, 201 | EEE. using email account ———— 
sent an email to Petraeus at email accoun ae The 


subject line of the email read: “what part of 4...” and the body of the email read: “is 
secret? The stuff in parenthesis, or the second sentence?” Based on my training, 
experience, and information teviewed to date in this investigation, the email related to a 
document or series of documents provided by Petraeus to SS which 
contained classified information.’ 

23, Between July 13, 2011 and July 15, 2011, RD and a U.S. Army Lieutenant 
Colonel exchanged numerous emails. i. = ——_ J using email account 

PR the Lieutenant Colonel at his military email 

account, ettns information about military operations conducted by the Lieutenant 
Colonel’s unit. In requesting this information, MM noted that in the past both 
storyboards and troop narratives had been useful in conveying such facts. In an email 


from the Lieutenant Colonel to Eon July 15, 2011, he advised he was 


*On June 27, 2012, FBI Tampa served a grand jury subpoena on Yahoo! for the 
account, On June 29, 2012, FBI Tampa executed a search warrant 
on the account. On September 7, 2012, FBI Tampa obtained an additional search warrant on the 
account. Search warrant results received on October 16, 2012 included emails between the dates 
- of July 1, 2012 and September 7, 2012. Because it is relevant to the current investigation what 
actions, if any, MY took regarding the emails in the 
account since the execution of the email search warrants by FBI Tampa, this affidavit seeks a 
search warrant requiring Yahoo! to disclose the entire contents of the account and not just the 
email content from September 7, 2012 to the present. 
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working on the storyboards and asked her for “a good SIPR number.” Later on July 15, 


2011, ES replied to the Lieutenant Colonel’s email and carbon copied (cc’d) 
Petraeus at emai! account .  _| 
response included the following: “{I]}f you have classified material, GEN Petraeus has 
been gracious enough to allow me to have you send the storyboards and material to his 
SIPR account; I’1] pick them up as soon as you send the word! I’ve copied him on this 
email. If it’s unclass, you can use my AKO or this account.” This email correspondence 
between {MM and the Lieutenant Colonel reflects some agreement by Petraeus 


to provide PY access to classified information. 


24. From June 12, 2011 through June 15, 2011, EEN, using email address 


os and Petraeus, using email address 
—— | , discussed several topics, to include files 


maintained by Petraeus. In the email string, which contained the subject line “Chapter 
2. fe raised issues which Petraeus addressed by typing in all capital letters 
within the body of J: original emails. In the email string, while 
discussing Petraeus’s files, EE cote, “[{T]he Galvin letters are naturally very 
helpful in this regard (I want more of them!!! I know you’re holding back...)” In 
response to this point in [MMM email, Petraeus wrote: “THEY’RE IN BOXES 
AND ’LL GET THEM OUT WHEN WE UNPACK AT THE HOUSE IN LATE 


JULY/AUG.” 


? SIPR is an acronym for Secure Internet Protocol Router network, a U.S. government 
communications system allowing the processing, storage, and communication of classified 
information up to the SECRET level. 


10 


Case 3:13-mj-00100-DSC *SEALED* Document 6-1 Filed 12/20/16 Page 11 of 24 


> i responded: “Thanks for your willingness to get out the boxes! SE 
=a the librarian at NDU, has the full collection as well, if it’s easier to just gain . 
access to them there.”® In response Petraeus wrote: “SHE DOESN’T HAVE THE FILES 
I'VE GOT AT HOME; NEVER GAVE THEM TO HER.” 


26. In an email string initiated on or about June 19, 2011, Petraeus, using email address 


———=_ | and a. using email address 
SSS aa exchanged over ten emails. In the first email, with the 


subject line “Found the”, Petraeus discussed locating his “Galvin files” as well as other 
files and expressed his willingness to share them with a. Petraeus wrote: 
“(G]iven various reassurances from a certain researcher, I will not triage them!” Your 
Affiant believes the term “triage” refers to the classified contents of the documents. 
HE. x pressed her excitement about Petraeus’s willingness to share the files 
writing: “[I]’ll protect them. And I’ll protect you.” Petraeus later responded to 
a: writing, “[Mly files at home only go up to about when I took cmd of the 
101%, though there may be some MNSTC-I and other ones. Somewhere in 2003, I 
stopped nice filing and just started chunking stuff in boxes that gradually have gone, or 
will go, to NDU. Can search them at some point if they’re upstairs, but they’re not 
organized enough at this point...’“ Petraeus continued, writing, “[A]nd I think MNSTC-I 


files went to NDU, though I’m not sure. The key to find there would be the weekly 


*NDU is an acronym for National Defense University. NDU is an institution of higher education 
funded by the United States Department of Defense, intended to facilitate high-level training, 
education, and the development of national security strategy. It is located on the grounds of Fort 
Lesley McNair in Washington, D.C. 

“MNSTC-I is an acronym for Multi-National Security Transition Command-Iraq. MNSTC-I 
was a branch of the Multi-National Force-Iraq (MNF-I). Petraeus was the former commander of 
MNF-I. 
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reports that the CIG did with me. Not sure if J kept copies. Class’d, but I guess I 
might share!” (emphasis added). 

27. Your affiant believes that Petraeus’s reference to “Class’d” means the documents he is 
discussing --- and which he indicates he is willing to provide to es o-- are 
classified. 

C. Continuing Communications Between es =: Petraeus 

28. a: Petraeus are believed to have had multiple telephonic contacts after 
each was made aware of FBI Tampa’s computer intrusion investigation. Your affiant 
asserts: 

a. Petraeus’s CIA security detail was notified of the FBI investigation on June 22, 
2012. In an interview with FBI Tampa on October 26, 2012, Petraeus 
acknowledged that: (1) he was briefed by the security detail concerning the FBI 


investigation, and (2) he called a on June 23, 2012 regarding the 


emails received by Witness 1. 


b. Over the weekend of August 11, 2012 and August 12, 2012, Petraeus spoke to 
Witness 1. In evidence reviewed by FBI Charlotte, a telephone number attributed 
to i called a telephone number attributed to Petraeus on August 11, 
2012. 

c. cis Ue was interviewed by FBI Tampa on September 24, 25, and 26, 
2012, A telephone number attributed to MMME-alled a telephone 
number attributed to Petraeus on three occasions on September 25, 2012. 

d. f was in contact with FBI Tampa on October 1 and 2, 2012. These 


contacts ultimately resulted in a telephone interview conducted on October 3, 
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2012. In evidence reviewed by FBI Charlotte, on October 2, 2012, there were six 
calls between telephone numbers attributed to (<= 4 and Petraeus. One 
of these calls connected, resulting in an approximately fifteen-minute-long 
conversation. 

e. During the October 26, 2012 interview of Petraeus by FB] Tampa, he stated that, 
while coming back from a trip to the Far East earlier in the month, he called 
fc who told him about her interview with the FBI. Evidence 
indicated that a telephone number attributed to Petraeus called a telephone 
number attributed to on October 16, 2012. 

f. Following FBI Tampa’s interview of Petraeus on October 26, 2012, a telephone 
number attributed to i 2a oi called a telephone number attributed to 
Petraeus on four occasions on October 27, 2012, on three occasions on October 
28, 2012, and on two occasions on October 29, 2012. 

g. On November 2, 2012, foes was again interviewed by FBI Tampa. 

PF stated that she and Petraeus had talked candidly since each of 
their interviews with the FBI. 

h. On November 9, 2012, NM contacted FBI Tampa telephonically from 
telephone number ip —— She advised she received a telephone call 
from Petraeus earlier that day advising her of his resignation. In evidence 
reviewed by FBI Charlotte, telephone number EEE called a telephone 
number attributed to Petraeus on November 9, 2012. 

29. The foregoing telephone communications identified in this affidavit only include calls 


made or received from one government phone attributed to Petraeus. As detailed above, 
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30. 


31. 


Petraeus and is =a have previously been in regular contact through email, and 
communicated about the provision of classified information mo 
Moreover, a. and Petraeus have admitted that they established covert 
communications systems using pre-paid cellular telephones and non-attributable email 
accounts. To date, the pre-paid telephone numbers used by Petraeus and aaa 
have not been identified. 
These telephonic contacts and attempted telephonic contacts between telephone numbers 
attributed to ae and Petraeus indicate relationship with 
Petraeus continued after their interviews with FBI Tampa in September and October 
2012. Based on these facts, and given history of email communication 
with Petraeus, there is probable cause to believe that MY ahoo! account 
contains substantive communications regarding the content of ee and 
Petraeus’s FBI interviews, including additional information regarding 
access to and retention of classified information. 

BACKGROUND CONCERNING EMAIL 
In my training and experience, I have learned that Yahoo! provides a variety of online 
services, including electronic mail (“email”) access, to the general public. Subscribers 
obtain an account by registering with Yahoo!. During the registration process, Yahoo! 
requests subscribers to provide basic personal information. Therefore, the computers of 
Yahoo! are likely to contain stored electronic communications (including retrieved aad 
unretrieved email for Yahoo! subscribers) and information concerming subscribers and 
their use of Yahoo! services, such as account access information, email transaction 


information, and account application information. Such information can include the 


14 


Case 3:13-mj-00100-DSC *SEALED* Document 6-1 Filed 12/20/16 Page 15 of 24 


- subscriber’s full name, physical address, telephone numbers and other identifiers, 
alternative email addresses, and, for paying subscribers, means and source of payment | : 
(including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the 


information can be used to identify the account’s user or users. |: 


32. In general, an email that is sent to a Yahoo! subscriber is stored in the subscriber’s “mail 
box” on Yahoo! servers until the subscriber deletes the email. If the subscriber does not 
delete the message, the message can remain on Yahoo! servers indefinitely: 

33, When the subscriber sends an email, it is initiated at the user’s computer, transferred via 
the Internet to Yahoo!’s servers, and then transmitted to its end destination. Yahoo! often 
saves a copy of the email sent. Unless the sender of the email specifically deletes the 


email from the Yahoo! server, the email can remain on the system indefinitely. 


34; A Yahoo! subscriber can also store files, including emails and other files, on servers 
maintained and/or owned by Yahoo!. 

35. Subscribers to Yahoo! might not store on their home computers copies of the emails 
stored in their Yahoo! account. This is particularly true when they access their Yahoo! 
account through the web, or if they do not wish to maintain particular emails or files in 
their residence. 

36. In my training and experience, email providers typically retain certain transactional 


information about the creation and use of each account on their systems. This 


information can include the date on which the account was created, the length of service, 


records of log-in (i.¢., session) times and durations, the types of service utilized, the 


status of the account (including whether the account is inactive or closed), the methods 
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used to connect to the account (such as logging into the account via the provider's 
website), and other log files that reflect usage of the account. In addition, email providers 
often have records of the Internet Protocol address (“IP address”) used to register the 
account and the IP addresses associated with particular logins to the account. Because 
every device that connects to the Internet must use an IP address, IP address information 
can help to identify which computers or other devices were used to access the email 
account, 

37. In my training and experience, in some cases, email] account users will communicate 
directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers 
typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well records of any actions taken 
by the provider or user as a result of the communications. In my training and experience, 
such information may constitute evidence of the crimes under investigation because the 
information can be used to identify the account’s user or users. 

LOCATION TO BE SEARCHED 

38. I anticipate executing this warrant under the Electronic Communications Privacy Act, in 
particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A), by using the warrant 
to require Yahoo! to disclose to the government copies of the records and other 
information (including the content of communications) particularly described in 
Attachment A. Upon receipt of the information described in Attachment A, the 


information described in Attachment B will be subject to seizure by law enforcement. 
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39. Based upon the foregoing, your affiant submits that probable cause exists for the issuance 
of a search warrant for information associated with a certain account, as more fully 
described in Attachment A to this affidavit, stored at premises owned, maintained, 
controlled, or operated by Yahoo! Inc., an email provider headquartered at 701 First 
Avenue, Sunnyvale, California 94089, to search for evidence of: (a) unauthorized 


removal and retention of classified documents and material, in violation of 18 U.S.C. 


§ 1924; (b) unauthorized possession and, inter alia, attempted communication and willful 
scientenantaiien of national defense information to someone not entitled to receive it, as 
well as the willful retention of national defense information, in violation of 18 U.S.C. 
§ 793(e); and (c) conspiracy to commit the aforementioned crimes, in violation of 18 
U.S.C. § 371. 
CONCLUSION 

40. Based on my training and experience, and the facts as - forth in this affidavit, your 

affiant asserts there is probable cause to believe that stored in the Yahoo! email account, 


ee here exists evidence of a crime relating to: (a) 


unauthorized removal and retention of classified documents and material, in violation of 


18 U.S.C. § 1924; (b) unauthorized possession and, inter alia, attempted communication 
and willful communication of national defense information to someone not entitled to 
receive it, as well as the willful retention of national defense information, in violation of 
18 U.S.C. § 793(e); and (c) conspiracy to commit the aforementioned crimes, in violation 


of 18 U.S.C. § 371. 


= 


41, Based on the foregoing, I request that the Court issue the proposed search warrant. 


Because the warrant will be served on Yahoo!, who will then compile the requested 
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records at a time convenient to it, there exists reasonable cause to permit the execution of 
the requested warrant at any time in the day or night. 

42. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by Title 18, United States Code, Section 271 1; and 
Title 18, United States Code, Sections 2703(a), (b)(1)(A), and (c)(1)(A). Specifically, the 
Court is “a district court of the United States that has jurisdiction over the offenses being 
investigated,” Title 18, United States Code, Sections 1924, 793(e), and 371. Pursuant to 

Title 18, United States Code, Section 2703(g), the eeseline of a law enforcement officer 


is not required for the service or execution of this warrant. 
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REQUEST FOR SEALING 


43. Since this investigation is continuing, disclosure of the search warrant, this affidavit, 
and/or this application and the attachments thereto will jeopardize the progress of the 
investigation. Accordingly, it is respectfully requested that the Court issue an order that 
the search warrant, this affidavit in support of the application for search warrant, the 


application for search warrant, and all attachments thereto be filed under seal until further 


order of this Court. 
Respectfully submitted, 
Gerd f AA Tr. 
Special Agent 


Federal Bureau of Investigation 


Sworn to and subscribed before me 


on this, the S day of April, 2013. 


sng dd 


ROBERT J. CO , IR. 
UNITED STATES*DISTRICT COURT GE 
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ATTACHMENT A 


Particular Account To Be Searched 


This warrant applies to records and other information (including the contents of 


communications) for the account associated with the email address Saw) 


that is stored at premises controlled by Yahoo!, a company that accepts service of legal process 


at 701 First Avenue, Sunnyvale, California 94089. 


20 


Case 3:13-mj-00100-DSC *SEALED* Document 6-1 Filed 12/20/16 Page 21 of 24 


ATTACHMENT B 
Particular Things To Be Seized 


1. _ Information To Be Disclosed by Yahoo! (“the Provider”) 


To the extent that the information described in Attachment A is within the 
possession, custody, or control of the Provider, including any emails, records, files, logs, or 
information that has been deleted but is stil] available to the Provider, or has been preserved 
pursuant to.a request made under 18 U.S.C. § 2703(f) on November 16, 2012 and February 14, 
2013, the Provider is required to disclose the following information to the government for the 
account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account, draft emails, the source and destination 
addresses associated with each email, the date and time at which each email was sent, and the 
size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, records of session 


times and durations, the date on which the account was created, the length of service, the IP 


address used to register the account, log-in IP addresses associated with session times and dates, 
account status, alternative email addresses provided during registration, methods of connecting, 
log files, and means and source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 


account, including address books, contact and buddy lists, calendar data, pictures, and files; and 
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i 

e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of actions taken. 
| 


IL. Information To Be Seized by the Government 


1, All records or information described above in Section I that constitute fruits, 


| 
evidence, and instrumentalities of violations of the statutes listed on the warrant, : 
including, for the account identified on Attachment A: 


a. All records or information related to-any communications between 


I 22 Pees 


1 
b. All records or formation related to any communications, from December | 


2008 to the present, between a any other person or entity 


concerning classified and/or national defense information; 

c. All records or information, from December 2008 to the present, related to any 
classified and/or national defense information; i 

d. All records or information, from December 2008 to the present, related to the 
source(s) or potential source(s) of any classified and/or national defense 
information provided to zm 

e. All records or information, from December 2008 to the present, related to the 
state of mind of any individuals concerning the ecpuisttibaier: disclosure, 


receipt, or retention of classified and/or national defense information; 


f. All records or information relating to knowledge of laws, rules, regulations, 
and/or procedures prohibiting the unauthorized disclosure or retention of i 


classified and/or national defense information; 
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g: All records or information related to any communications from June 2012 to 
the present between and any other person conceming ongoing 
law enforcement investigations; 

h, All records or information concerning any email accounts, telephone numbers, - 
or other methods of communication used by or Petraeus; 

i. Any information recording [en = = or Petraeus’s schedule or travel 
from December 2008 to the present; 

j. Evidence of user attribution showing who used or owned the Device at the 
time the items described in this warrant were created, edited, or deleted, such 
as logs, phonebooks, address books, contact lists, saved usernames and 
passwords, documents, and browsing history; and 

k. Records evidencing the use of the Internet, including records of Internet 
Protocol addresses used; 

2. Information relating to who created, used, or communicated with the account, 
including records about their identities and whereabouts. 

3. As used above, the terms “records” and “information” include all of the foregoing 
items of evidence in whatever form and by whatever means they may have been 
created or stored, including any form of computer or electronic storage (such as flash 


memory or other media that can store data) and any photographic form. 
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FILED 


UNITED STATES DISTRICT COURT FOR THE : 


WESTERN DISTRICT OF NORTH CAROLINA DEC 20 2016 | 
CHARLOTTE DIVISION i: 
US Distri 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-10Wvestern Baneeie 
v. MOTION TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT | 
IN THE MATTER OF THE SEARCH OF AND APPLICATION | 


FORENSIC IMAGES OF IPHONE, 2 
LAPTOPS, AND 2 EXTERNAL HARD 
DRIVES AS DESCRIBED IN AFFIDAVIT 
AND ATTACHMENT, INCORPORATED 
HEREIN. 


) 
) 
) 
) 
CONTENT OF EMAIL ACCOUNTS; ; 
) 
) 
) 
) 


NOW COMES the United States of America, by and through Jill Westmoreland Rose, 
United States Attorney for the Western District of North Carolina, who respectfully shows unto 


the Court that on April 4, 2013, the court issued a search warrant in the above-captioned case and 


| 
placed under seal the warrant, the application for the warrant and the affidavit in support of the . 
application for the warrant; after reviewing the materials in connection with pending Freedom of 
Information Act litigation in the United States District Court for the District of Columbia, the 
United States now seeks to unseal said documents, subject to redactions of personal identifying | 
information, pursuant to Local Criminal Rule 49(B) of this Court (the search warrant materials, 
as redacted by the government, are attached hereto). 

THEREFORE, the United States respectfully moves the Court for the search warrant, the 
application for the warrant, and the affidavit in support of the application for the warrant listed 
above be unsealed. 


Respectfully submitted, on this day of December 19, 2016. 


JILL WESTMORELAND ROSE | 
UNITED STATES ATTORNEY 


/s//JILL WESTMORELAND ROSE 
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ASSISTANT UNITED STATES ATTORNEY 
NC Bar Number # 17656 

Attorney for USA 

Carillon Bldg, Suite 1700 

227 West Trade Street 

Charlotte, NC 28202 

Phone: 704-344-6222 

Fax: 704-344-6629 


Email: jill.rose@usdoj.gov 


Case 3:13-mj-00101-DSC *SEALED* Document5 Filed 12/20/16 Page 2 of 2 


UNITED STATES DISTRICT COURT FOR THE 


WESTERN DISTRICT OF NORTH CAROLINA 


CHARLOTTE DIVISION 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-101 
v. ORDER TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF AND APPLICATION 


) 
) 
) 
CONTENT OF EMAIL ACCOUNTS; ) 
FORENSIC IMAGES OF IPHONE, 2 ) 
LAPTOPS, AND 2 EXTERNAL HARD ) 
DRIVES AS DESCRIBED IN AFFIDAVIT ) 
AND ATTACHMENT, INCORPORATED ) 
HEREIN. ) 


UPON MOTION of the United States of America, by and through Jill Westmoreland 
Rose, United States Attorney for the Western District of North Carolina, it appearing that on 
April 4, 2013, the Court issued a search warrant in the above-captioned case and placed under 
seal the warrant, the application for the warrant, and the affidavit in support of the application for 
the warrant; it further appearing that the government, after reviewing the materials in connection 
with pending Freedom of Information Act litigation in fie United States Court for the District of 
Columbia, now seeks to unseal said documents, subject to redactions of personal identifying | 
information, pursuant to Local Criminal Rule 49(B) of this Court (the search warrant materials, 
as redacted by the government are attached hereto), it is hereby 

ORDERED that the search warrant, application for search warrant, and affidavit in 
support of the application for the search warrant, as redacted by the government, are hereby 

- UNSEALED. 

The Clerk is directed to certify copies of this Order to the United States Attorney's 

Office. 


This the Q Oday of December, 2016. 
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KO 93 (Rev. 12/09) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
Western District of North Carolina 


In the Matter of the Search of ) Coriif on 
(Briefly describe the property to be searched ) — to tera bug 
or identify the person by name and address) ) Case No. 3 : 13 mn : / 6 { : Copy 
Content of email accounts; forensic images of iPhone, 2 ; : [ A 
laptops, and 2 external hard drives, as described in 
Affidavit and Attachment, incorporated herein. ) 
By. 


SEARCH AND SEIZURE WARRANT 
To: Any authorized law enforcement officer Pirie 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Western District of North Carolina 


(identify the person or describe the property to be searched and give its location): 
See Attachment A, which is incorporated fully herein. 


The person or property to be searched, described above, is believed to conceal (identify the person or describe the 


property to be seized): i ; 
See Attachment B, which is incorporated fully herein. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 
property. 


YOU ARE COMMANDED to execute this warrant on or before April 17, 2013 
(not to exceed 14 days) 
07 in the daytime 6:00 a.m. to 10 p.m. oS at any time in the day or night as I find reasonable cause has been 
established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. ; 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge 
Robert J. Conrad, Jr. 

(name) 


©) I find that immediate notification may have an adverse result listed in 18 U.S.C, § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be 
searched or seized (check the appropriate box) (1) for days (not to exceed 30). 


© until, the facts justifying, the later specific date of 


Date and time issued: Yy «Bel 3 x 35 Pp. Hai 
ludge's signature 


Ciey-and state: Charlotte, North Carolina Robert J. Coltrad, U.S. District Court Judge 
Printed name and title 
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AO 93 (Rev. 12709) Search and Seizure Warrant {Page 2) 


Case No.: i Date and time warrant executed: Copy of warrant and inventory left with: 
Z.1Bm, 16] 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


I declare under penalty of perjury that this inventory is correct and was returned along with the original 
warrant to the designated judge. 


Executing officer's signature 


Printed name and title 
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AQ 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT FILED 


CHARLOTTE, NC 
for the 
Western District of North Carolina © APR 4 2013 
In the Matter of the Search of ) US District Court 

‘Briefly describe th b hed ‘ 

@ an the perso by name and address) ; Case No. 4 . 13 mn | O Western District of NC 
Content of email accounts; forensic images of iPhone, 2 ) | 

laptops, and 2 external hard drives, as described in } 


Affidavit and Attachments, incorporated herein. 
APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


a ee ea er reR ater EE peat ated fully herein. 


located in the Western District of North Carolina , there is now concealed (identify the 
person or describe the property to be seized): Ana ; 
See Attachment B, which is incorporated fully herein. Vertified to be d true an: 
correct copy 
-US.h 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 
ot contraband, fruits of crime, or other items illegally possessed; 
O property designed for use, intended for use, or used in committing a crime; 
Gj aperson to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Deseri tion 
418 USC 1924; 18 USC 793{e); Unauthorized removal and retention of classified documents or material; 
18 USC 371 Unauthorized possession, communication, and willful retention of national defense 


information; Conspiracy 


The application is based on these facts: 


& Continued on the attached sheet. 


© Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Applicant's signature 


Gerd J. Baliner, Special Agent, FBI 


Printed name and title 


Sworm to before me and signed in my presence, 


Date: 04/03/2013 
Judge's signature 


City and state: Charlotte, North Carolina Robert J. Conrad\yr., United States District 


Printed name and title 
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AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT 


I, Gerd J. Ballner, Jr., being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 
1. I make this affidavit in support of an application for a search warrant for information 
associated with email accounts =: [i 
Eas and PY as well as forensic images of an 


Apple iPhone (serial number C28J60GKDTDD), two laptop computers (Apple MacBook 
Air, serial number CO2HF37GDJWV, and IBM/Lenova, serial number L3-AY867), and 
two external hard drives (Toshiba 500GB, serial number 523GFNJASN69, and LaCie, no 
visible serial number), which were previously searched and seized pursuant to oud 


warrants or by consent during a computer intrusion investigation conducted by Federal 


Bureau of Investigation (FBI) Tampa Division.' All items are currently stored at the FBI 
Charlotte Field Office at 7915 Microsoft Way, Charlotte, North Carolina 28273. The 

| items identified above are stored ina GSA-approved safe in a Sensitive Compartmented 
Information Facility, which is accessible only by FBI Charlotte Acting ASAC Scott 


Cheney, who is the designated filter agent on this investigation” The specifics of the 


* The following items were obtained by FBI Tampa by way of séarch warrants: email accounts 
eres ee rs 
es The rou0wing items were obtained by FBI Tampa by way of consent: 


| 
forensic images of an Apple iPhone (serial number C28J60GKDTDD), two laptop computers | 
(Apple MacBook Air, serial number CO2HF37GDIWYV, and IBM/Lenova, serial number L3- 
AY867), and two external hard drives (Toshiba 500GB, serial number 523GFNJASN69, and 
LaCie, no visible serial number). 
* The items which this affidavit seeks authority to search were originally seized, both pursuant to 
warrants and by way of consent, in a computer intrusion investigation by FBI Tampa, Those | 
warrants did not permit the FBI to search for or seize items relating to the unlawful removal, 
communication, or storage of classified information, and the consent to search the laptop 
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information to be searched and items to be seized are more fully described in 
Attachments A and B, which are incorporated fully by reference herein. 

2. I ama Special Agent with the FBI and have been employed as such for approximately 
thirteen years. I have investigated matters involving National Security to include 
Counterintelligence and Espionage. I am currently assigned to the Charlotte, North 
Carolina FBI office. Through investigations, experience, and training, I have become 
familiar with methods and operations employed by hostile foreign intelligence services 
and their recruited human sources to illegally obtain, through clandestine action, 
classified and proprietary information, which if compromised poses grave danger to the 
national security of the United States. I have also received specialized training in the 
proper collection, retention, and dissemination of classified information. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, evidentiary review, and information obtained from other Agents, government 
officials, and witnesses. This affidavit is intended to show merely that there is sufficient 
probable cause for the requested warrant and does not set forth all of my knowledge 
about this matter. 

STATUTORY AUTHORITY 

4, The FBI is conducting .an investigation of ee for possible violations 

of: (a) unauthorized removal and retention of classified documents and material, in 


violation of Title 18, United States Code, Section 1924; (b) unauthorized possession and, 


computers, external hard drives, and iPhone was obtained during the course of a voluntary 
interview focused on cyber stalking activities. The items have been stored by FBI Charlotte in 
the care of a filter agent. This filter agent has retained sole custody of the items to ensure no 
access to the information has been provided to agents investigating the matter under the statutes 
set forth in this affidavit. 
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inter alia, attempted communication and willful communication of national defense 


information to someone not entitled to receive it, as well as the willful retention of 

national defense information, in violation of Title 18, United States Code, Section 793(e); 

(c) conspiracy to commit the aforementioned crimes, in violation of Title 18, United 

” "States Code, Section 371. 

. For the reasons set forth below, there is probable cause to believe that the email accounts 
Se  .: 
HE 2s well as forensic images of an Apple iPhone (serial number 


C28J60GKDTDD), two laptop computers (Apple MacBook Air, serial number 
C02HF37GDJIWV, and IBM/Lenova, serial number L3-A Y867), and two external hard 
drives (Toshiba 500GB, serial number 523GFNJASN69, and LaCie, no visible serial 
number) contain evidence, fruits, and/or instrumentalities of violations of federal law, 
including, inter alia, the unlawful communication and/or retention of classified 
information. The items to be searched described in this paragraph consist entirely of 
items previously seized by the FBI pursuant to court authorized search warrants ai by 
consent. All of the items remain in the FBI’s possession. The prior search warrants 
allowed the FBI to search the items and seize materials relating to what was at the time 
an investigation into a potential cyber stalking matter, as more fully explained below. 
The instant request for a search warrant of those items is made to pennit the FBI to 
search those items which are in the FBI’s possession and seize materials. relating to the 
violations set forth in paragraph 4 above. With regard to the email accounts identified 
above, the materials in the FBI’s possession consist of data provided by internet service 


providers pursuant to service of the prior search warrants in the cyber stalking 
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investigation. The instant request is made to allow the FBI to search that data and seize 
those materials relating to violations set forth in paragraph 4 above. 
6. Title 18, United States Code, Section 1924(a) states: 


Whoever, being an officer, employee, contractor, or consultant of the United 
States, and, by virtue of his office, employment, position, or contract, becomes 
possessed of documents or materials containing classified information of the 
United States, knowingly removes such documents or materials without authority 
and with the intent to retain such documents or materials at an unauthorized 
location shall be fined under this title or imprisoned for not more than one year, or 
both: 


18 U.S.C. § 1924(a). 
7. Title 18, United States Code, Section 793(e) states: 
Whoever having unauthorized possession of, access to, or contro! over any 
document, writing, code book, signal book, sketch, photograph, photographic 
negative, blueprint plan, map, model, instrument, appliance, or note relating to the 
national defense, or information relating to the national defense which 
information the possessor has reason to believe could be used to the injury of the 
United States or to the advantage of any foreign nation, willfully communicates, 
delivers, transmits or causes to be communicated, delivered, or transmitted, or 
attempts to communicate, deliver, transmit or cause to be communicated, 
delivered, or transmitted the same to any person not entitled to receive it, or 
willfully retains the same and fails to deliver it to the officer or employee of the 
United States entitled to receive it... shall be fined under this title or imprisoned 
not more than ten years or both. ; 
18 U.S.C. § 793(e). 

8. Title 18, United States Code, Section 371, makes punishable, by up to five years in 
prison, a conspiracy among two or more persons to commit any offense against the 
United States. 

9. Ctassified information is defined by Executive Order 13526 (E.O. 13526) and relevant 
preceding Executive Orders, as information in any form that: (1) is owned by, produced 


by or for, or under the control of the United States government; (2) falls within one or 


more of the categories set forth in the E.O. 13526; and (3) is classified by an original 


4 


Case 3:13-mj-00101-DSC *SEALED* Document 6-1 Filed 12/20/16 Page 5 of 23 


10. 


I 


— 


classification authority who determines that its unauthorized disclosure reasonably could 
be expected to result in damage to the national security. Where such funautharteea 
disclosure reasonably could be expected to cause “damage” to the national security, the - 
information is classified as “Confidential.” Where such unauthorized disclosure 
reasonably could be expected to cause “serious damage” to the national security, the 
information is classified as “Secret.” Where such unauthorized disclosure reasonably 
could be expected to cause “exceptionally grave damage” to the national security, the 
information is classified as “Top Secret.” 

Pursuant to E.O. 13526, a person may only gain access to classified information if a 
favorable determination of eligibility for access has been made by an agency head or an 
agency head’s designee, the person has signed an approved nondisclosure agreement, and 
the person has a need-to-know the information. 


PROBABLE CAUSE 


. David Petraeus is a retired United States Army General. From on or about October 31, 


2008 to June 30, 2010, Petraeus served as Commander of the United States Central 
Command. From on or about July 4, 2010 to July 18, 2011, Petraeus served as 
Commander of the International Security Assistance Force. From on or about September 
6, 2011 to November 9, 2012, Petraeus served as Director of the Central Intelligence 
Agency (CIA). At all times relevant to this affidavit, Petraeus held a United States 
government security clearance allowing him access to classified United States 
government information. According to a Department of Defense (DOD) official, to 
obtain that clearance, Petraeus was required to and would have agreed to properly protect 


classified information by not disclosing such information to persons not entitled to 
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receive it, by not unlawfully removing classified information from authorized storage 
facilities, and by not storing classified information in unauthorized locations. 

12. ——ae is a researcher and author of a biography of Petraeus, published in 
January 2012. From on or about July 18, 2003 until on or about November 14, 2012, 

MR held a United States government security clearance allowing her access to 

classified United States government information. According to a DOD official, to obtain 
that clearance, was required to and would have agreed to properly protect 
classified information by not disclosing such information to persons not entitled to 
receive it, by not unlawfully removing classified information from authorized storage 
facilities, and by not storing classified information in unauthorized locations. 

13. In June 2012, the FBI’s-Tampa Division (FBI Tampa) opened a computer intrusion 
investigation related to alleged cyber stalking activity. This investigation was predicated 


_ on a complaint received from Witness 1, which alleged the receipt of threatening and 


harassing emails from the email addresses A and 


ee dl] Witness 1 claimed friendships with several high-ranking 


public and military officials. 

14. Evidence gathered during the FBI Tampa investigation indicated that someone had access 
to the personal schedule of Petraeus, who was then the Director of the CIA. This access 
indicated a potential breach of security. On or about June 22, 2012, FBI Headquarters 
(FBIHQ) notified Petraeus’s security detail of the ongoing computer intrusion 
investigation and the potential security issue. On July 19, 2012, FBI Tampa was notified 
by Witness 1 that he/she no longer wished to press charges against the cyber stalker. On 


August 10, 2012, Witness 1 informed FBI Tampa that Petraeus personally requested that 
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Witness | withdraw his/her complaint and “call off the G-men.” On August 13, 2012, 
Witness 1 advised FBI Tampa that Petraeus believed the alleged cyber stalker possessed 
information which could “embarrass” Petraeus and other public officials. 
15. Investigation conducted by FBI Tampa identified PY as the person 
" suspected of using the email accounts iS and 
«ferred to above. Investigation also determined 
HR. used the email account je | On September 24, 


2012, FBI Tampa interviewed ae = her residence. During this voluntary 
interview, EE 2dmitted sending the emails to Witness 1, as well as other 
emails regarding Witness 1 to senior United States military officers as well as a foreign 
diplomat. PY also stated that she had engaged in an extramarital affair with 
Petraeus. HE provided consent to search two of her laptop computers and 
two external hard drives. The computers were imaged by FBI Computer Analysis 
Response Team (CART) Forensic Examiners. 

16. On September 25, 2012, FBI Tampa returned Po laptop computers and 
conducted a follow-up interview. During this follow-up interview, == 
admitted she told Petraeus that he should get Witness 1 to “drop the charges.” 

——= I advised agents that she did not know if Petraeus made the request of 
Witness 1. During the course of this interview, HR provided interviewing 
agents consent to search her Apple iPhone, which she had in her possession. FBI CART 
>On June 29, 2012, FBI Tampa executed a search warrant on the 
account, On September 7, 2012, FBI Tampa obtained an additional search warrant on the 
account. Search warrant results received on October 16, 2012 included emails between the dates 


of July 1, 2012 and September 7, 2012. On June 29, 2012, FBI Tampa executed a’ search warrant 
on the I account. On July 20, 2012, FBI Tampa executed a search 


warrant on the I account 
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Forensic Examiners imaged the contents of her Apple iPhone at the interview location, 
and the iPhone was returned to — at the conclusion of the interview. A later 
review of i ; laptops and external hard drives located over 100 items 
which were identified by CART Forensic Examiners as containing potentially classified 
information, including information classified up to the Secret level.* 

17. On October 26, 2012, Petraeus was interviewed at CIA Headquarters, Petraeus stated 
that he had had an extramarital affair with MN. He denied providing any 
classified documents to =f or having any arrangement to provide her with 
classified information. Petraeus stated that aay may have obtained 
documents in the course of conducting research for a book she was writing. He explained 
that reporters in theater (Afghanistan), such as HR, were sometimes granted 
“off-the-record” access to classified presentations, such as the COMISAF’s (Commander, 
International Security Assistance Force) daily briefings. | 

18. On November 2, 2012, FBI Tampa interviewed (in Charlotte, North 
Carolina regarding the potentially classified documents found on her computers. She 
claimed she came into possession of several of the documents when she was in 
Afghanistan researching her book about Petraeus; however, she was unable to provide 
specifics as to how she obtained them. HE stated that during her time in 
Afghanistan she was given access to several briefings, including at least one briefing at 
the Secret level. [NM advised that reporters were often given such access in 
order to provide them with situational awareness of the war. In order to receive the 
briefings, =———sz)) signed an “off-the-record” agreement, which meant she could 


“On September 26, 2012, FBI Tampa again met with [EM and retumed the two 
external hard drives, which had also been imaged by CART Forensic Examiners. 
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not write about classified information she observed. She stated she would sometimes 


obtain a paper copy of the briefings to preserve the information as research for her book. 


a. advised that she never received classified information from Petraeus. 
19. During interviews conducted of and Petraeus under the aforementioned 
FBI Tampa investigation, each advised they used covert methods to communicate with 
one another. These methods included the use of pre-paid cellular telephones and email 
accounts using non-attributable names. Several of these covert email accounts were 
identified during the FBI Tampa investigation; however, it is not known if all the 
accounts were identified because both and Petraeus stated they could not 
recall all the account names which they created and used to communicate. During 
EE Septet: 25, 2012 interview, she advised that she and Petraeus would 
sometimes share the same account, and would save messages to the draft folder instead of 
sending them via email. ; 


A. HS Consensual Search, November 12, 2012 


20. As a result of finding potentially classified information on the laptops provided by 
a. FBI Tampa and FBI Charlotte conducted a consensual search of 
HE Charlotte residence on Hovernbes 12, 2012 to recover any evidence 
related to cyber stalking, in violation of 18 U.S.C. § 2261A, and the unauthorized | 


removal and retention of classified documents or material, in violation of 18 U.S.C. 


§ 1924. On this same date, a consensual search was also conducted at the residerice of 


wee administrative assistant, J. in Concord, North 
Carolina. = voluntarily provided the FBI with various items she maintained in 


her home in relation to her employment with a. During the searches, 


9 


Case 3:13-mj-00101-DSC *SEALED* Document 6-1 Filed 12/20/16 Page 10 of 23 


additional paper documents were found, some of which, upon belief and information of 
your affiant, are classified. As a result of the two searches, the following digital media 
were seized: eight computers, twelve external hard drives, two printers/scanners, two 
cellular telephones, two Apple iPods, seven thumbdrives/memory cards, and 
approximately fifty floppy discs, CDs, and optical discs.° 
21. Based on a preliminary review of digits media, it is believed she came 
into possession of potentially classified information both before and during the weitinig of 
her book, “All In: The Education of General David Petraeus.” Of the potentially 
classified documents reviewed to date, the majority relate to U.S. military operations 
conducted in Afghanistan. Given her extensive use of digital media, your affiant believes 
GR eceived/exchanged classified information via email and/or made contact 
with individuals via email and/or telephone to schedule in-person meetings for the 
purpose of recording and collecting classified information, as detailed below. 
fF is also known to have digitally stored numerous documents, photographs, 
and audio interviews which contain classified information. 


B. Communications Regarding the Potential Mishandling of Classified 
Informatien 


22. On May 12, 2011 IERIE using email account 
sent an email to Petraeus at email account . The 


subject line of the email read: “what part of 4...” and the body of the email read: “is 
secret? The stuff in parentheses, or the second sentence?” Based on my training, 


experience, and information reviewed to date in this investigation, the email related to a 


° These items include the two laptops and two external hard drives previously provided by 
to FBI on September 24, 2012. 
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document or series of documents provided by Petraeus to MM which 
contained classified information. 

23. Between July 13, 2011 and July 15, 2011, MM and a U.S. Army Lieutenant 
Colonel exchanged numerous emails. using email account 
—Eeeeeeeee emailed the Lieutenant Colonel at his military email 
account, seeking information about military operations conducted by the Lieutenant 
Colonel’s unit. In requesting this information, HR noted that in the past both 
storyboards and troop narratives had been useful in conveying such facts. In an email 
from the Lieutenant Colonel to MBbn July 15, 2011, he advised he was 
working on the storyboards and asked her for “a good SIPR number.”® Later on July 15, 
201 i, replied to the Lieutenant Colonel’s email and carbon copied (cc’d) 
Petraeus at email account : [cas 2 
response included the feliggands “ST]f you have classified material, GEN Petraeus has 
been gracious enough to allow me to have you send the storyboards and materia! to his 
SIPR account; Il] pick them up as soon as you send the word! I’ve copied him on this 
email. If it’s unclass, you can use my AKO or this account.” This email correspondence 
between B=] and the Lieutenant Colonel reflects some AGieeieit by Petraeus 
to provide HE access to classified information. 

24, From June 12, 2011 through June 15, 201 i. using email address 


be = and Petraeus, using emai] address 
ee |, discussed several topics, to include files 


* SIPR is an acronym for Secure Internet Protocol Router network, a U.S. government 
communications system allowing the processing, storage, and communication of classified 
information up to the SECRET level. 
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maintained by Petraeus. In the email string, which contained the subject line “Chapter 
2,” EM raised issues which Petraeus addressed by typing in all capital letters 
within the body of ME original emails. In the email string, while 
discussing Petraeus’s files wrote, “[T]he Galvin letters are naturally very 


helpful in this regard (I want more of them!!! I know you’re holding back...)” In 


response to this point in MM email, Petraeus wrote: “THEY’RE IN BOXES 
AND PLL GET THEM OUT WHEN WE UNPACK AT THE HOUSE IN LATE 
JULY/AUG.” 
25 Responded: “Thanks for your willingness to get out the boxes! I 
MER the librarian at NDU, has the full collection as well, if it’s easier to just gain 
access to them there.”” In response Petraeus wrote: “SHE DOESN’T HAVE THE FILES 
I’VE GOT AT HOME; NEVER GAVE THEM TO HER.” 


26. In an email string initiated on or about June 19, 2011, Petraeus, using email address 


Po and == using email address 
. ¢xchanged over ten emails. In the first email, with the 
subject line “Found the”, Petraeus discussed locating his “Galvin files” as well as other 
files and expressed his willingness to share them with EEE. Petraeus wrote: 
“(Given various reassurances from a certain researcher, I will not triage them!” Your 
affiant believes the term “triage” refers to the classified contents of the documents. 
FY expressed her excitement about Petraeus’s willingness to share the files 
Waiting “{I]'ll protect them. And I’ll protect you.” Petraeus later responded to 

”NDU is an acronym for National Defense University. NDU is an institution of higher education 

funded by the United States Department of Defense, intended to facilitate high-level training, 


education, and the development of national security strategy. It is located on the grounds of Fort 
Lesley McNair in Washington, D.C. 
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. HS, writing, “[M}y files at home only go up to about when I took cmd of the 
101", though there may be some MNSTC-I and other ones. Somewhere in 2003, I 
stopped nice filing and just started chunking stuff in boxes that gradually have gone, or 
will! go, to NDU. Can search them at some point if they’re upstairs, but they’re not 
organized enough at this point.. .”* Petraeus continued, writing, “[A]nd I think MNSTC-I 
files went to NDU, though I’m not sure. The key to find there would be the weekly 
reports that the CIG did with me. Not sure if MJ kept copies. Class’d, but I guess I 
might share!” (emphasis added). 

27. Your affiant believes that Petraeus’s reference to “Class’d” means the documents he'is 
discussing --- and which he indicates he is willing to provide to ic ai --- are 
classified. 

C. Continuing Communications Between ead Petraeus 

28. eo and Petraeus are believed to have had multiple telephonic contacts after 
each was made aware of FB] Tampa’s computer intrusion investigation. Your affiant 
asserts: . 

a, Petraeus’s CIA security detail was notified of the FBI investigation on June 22, 
2012. In an interview with FBI Tampa on October 26, 2012, Petraeus 
acknowledged that: (1) he was briefed by the security detail concerning the FBI 
investigation, and (2) he called on June 23, 2012 regarding the 


emails received by Witness 1. 


®MNSTC-I is an acronym for Multi-National Security Transition Command-Iraqg. MNSTC-I 
was a branch of the Multi-National Force-Iraq (MNF-I). Petraeus was the former commander of 
MNF-I. 
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b. Over the weekend of August 11, 2012 and August 12, 2012, Petraeus spoke to 
Witness 1. In evidence reviewed by FBI Charlotte, a telephone number attributed 
oo iii called a telephone number attributed to Petraeus on August 11, 
2012. 

c. a interviewed by FBI Tampa on September 24, 25, and 26, 
2012, A telephone number attributed to called a telephone 
number attributed to Petraeus on three occasions on Septemiber 25, 2012. 

d. a. was in contact with FBI Tampa on October | and 2, 2012. These 
contacts ultimately resulted in a telephone interview conducted on October 3, 
2012. In evidence reviewed by FBI Charlotte, on October 2, 2012, there were six | 
calls between telephone numbers attributed to [NN and Petracus. One 
of these calls connected, resulting in an approximately fifteen-minute-long 

" conversation. 

e. During the October 26, 2012 interview of Petraeus by FBI Tampa, he stated that, 

while coming back from.a trip to the Far East earlier in the month, he called 


= 75 who told him about her interview with the FBI. Evidence 


indicated that a telephone number attributed to Petraeus called a teleptiene 
number attributed to. on October 16, 2012. 

f. Following FBI Tampa’s interview of Petraeus on October 26, 2012, a telephone 
number attributed to [NN called a telephone number attributed to 
Petraeus on four occasions on October 27, 2012, on three occasions on October — 


28, 2012, and on two occasions on October 29, 2012. 
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g. On November 2, 2012, (== | was again interviewed by FBI Tampa: i! 


[= -—-_| stated that she and Petraeus had talked candidly since each of 


their interviews with the FBI. 
h. On November 9, 2012, TE contacted FBI Tampa telephonically from 
telephone number i She advised she received a telephone call 


from Petraeus earlier that day advising her of his resignation. In evidence 


reviewed by FBI Charlotte, telephone number i < —— «| called a telephone 7 
number attributed to Petraeus on November 9, 2012. . 
29. The foregoing telephone communications identified in this affidavit only include calls 
made or received from one sass phone attributed to Petraeus. As detailed above, 
. 
Petraeus and a. have previously been in regular contact through email, and 
communicated about the provision of classified information to (__——— 


Moreover, (im —— 2 =] and Petraeus have admitted that they established covert 


accounts. One of the non-attributable email accounts used by i was 


fF To date, the pre-paid telephone numbers used by Petraeus and 
—Ssz have not been identified. 


30. These telephonic contacts and attempted telephonic contacts between telephone numbers 


attributed to a. and Petraeus indicate J relationship with 


Petraeus continued after their interviews with FB] Tampa in September and October 


| 
| 
| 
communications systems using pre-paid cellular telephones and non-attributable email 
| 
I 
! 
i} 


2012. Based on these facts, and given Ee history of email communication 
with Petraeus, there is probable cause to believe that the Po 


° On September 5, 2012, FBI Tampa executed a search warrant on the [nn 
account, ‘ . 
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account as well as the JMMeccount contain substantive communications 


regarding the content of ME and Petraeus’s FBI interviews, including 


additional information regarding [SoS | access to and retention of classified | 
information. ; | 
LOCATION TO BE SEARCHED 
31. Based upon the foregoing, your affiant submits that probable cause exists for the issuance 
of a search warrant to search the evidence previously seized by FBI Tampa, to include 
“email accounts iS Ss . | 
SE: EE 2s well as forensic images of an 
iPhone (serial number C28J60GKDTDD), two laptop computers (Apple MacBook Air, ; | 
serial number CO2HF37GDJWV, and IBM/Lenova, serial number L3-AY867), and two | 
external hard drives (Toshiba 500GB, serial number 523GFNJASN69, and LaCie, no 
. Visible serial number), all of which are stored at the FBI Charlotte Field Office at 7915 
Microsoft Way, Charlotte, North Carolina 28273. The items are stored ina GSA- 
approved safe in a Sensitive Compartmented Information Facility, which is accessible 
only by Acting ASAC Scott Cheney, the designated filter agent in the investigation. 
CONCLUSION 
32. Based on my training and experience, and the facts as set forth in this affidavit, your 
affiant asserts there is probable cause to believe that within the aforementioned items 
there exists evidence of a crime relating to: (a) unauthorized removal and retention of * 
classified documents and material, in violation of 18 U.S.C. § 1924; (b) unauthorized 


possession and, inter alia, attempted communication and willful communication of 


national defense information to someone not entitled to.receive it, as well as the willful 
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retention of national defense information, in violation of 18 U.S.C. § 793(e): and (c) 
conspiracy to commit the aforementioned crimes, in violation of 18 U.S.C. § 371. 

33. Based on the foregoing, I request that the Court issue the proposed search warrant. 
Because the warrant will be served on the Federal Bureau of Investigation, there exists 
‘eaeenible cause to permit the execution of the requested warrant at any time in the day 


or night. 
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REQUEST FOR SEALING 


34. Since this soveeiestien is continuing, disclosure of the search warrant, this affidavit, 
and/or this application and the attachments thereto will jeopardize the progress of the 
investigation. Accordingly, it is respectfully requested that the Court issue an order that 
the search warrant, this affidavit in support of the application for search warrant, the 
application for search warrant, and all attachments thereto be filed under seal until further 


order of this Court. 


Respectfully submitted, 


Gerd t 44 Jr. 


Special Agent 
Federal Bureau of Investigation 


Sworn to and subscribed before me 


on this, the 3ef___day of April, 2013. 


UNITED STA Ss pea COURTAUDGE 
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ATTACHMENT A 


Particular Items To Be Searched 


This warrant applies to records and other information contained within evidence seized 


by FBI Tampa pursuant to warrants or by consent in a computer intrusion investigation of 


BEE 0 ite: 


1. 


Content of email account [i received by FBI Tampa 


pursuant to search warrants executed on June 29, 2012 and September 7, 2012; 


Content of email account EE received by FBI Tampa pursuant to 


a search warrant executed September 5, 2012; 


. Content of email account Po received by FBI Tampa pursuant 


to a search warrant executed June 29, 2012; 

Content of email account | received by FBI Tampa pursuant 
to a search warrant executed July 20, 2012; 

Forensic image of an Apple iPhone, serial number C28J60GKDTDD, obtained by 
consent on September 25, 2012; 

Forensic image of an Apple MacBook Air laptop computer, serial number 
C02HF37GDIWV, obtained by consent on September 24, 2012; 

Forensic image of an IBM/Lenova laptop computer, serial number L3-A Y867, 
obtained by consent on September 24, 2012; 

Forensic image of a Toshiba 500GB external hard drive, serial number 
523GFNJASN69, obtained by consent on September 24, 2012; and 

Forensic image of a LaCie external hard drive, no visible serial number, obtained by 


consent on September 24, 2012; 
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all of which are stored in a GSA-approved safe in a Sensitive Compartmented Information 
Facility located at the FBI Charlotte Field Office at 7915 Microsoft Way, Charlotte, North 


Carolina 28273. 
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ATTACHMENT B 


Particular Things To Be Seized 


I Information To Be Seized by the Government 


1. All records or information that constitute fruits, evidence, and instrumentalities of 


violations of the statutes listed on the warrant, including: M4 


a. All records or information related to any communications between 


ME anc Petracus; | 


b. All records or information related to any communications, from December 


2008 to the present, between End any other person or entity 


concerning classified and/or national defense information; 

c. All records or information, from December 2008 to the present, related to any 
classified and/or national defense information; 

d. All records or information, from December 2008 to the present, related to the |! 
source(s) or voinnial source(s) of any classified and/or national defense | 
information provided mY and any involvement of Petraeus in’ : | 
such; | 

e. All records or information, from December 2008 to the present, related to the 
state of mind of any individuals concerning the communication, disclosure, 
receipt, or retention of classified and/or national defense information; 7 : 

f. All records or information relating to knowledge of laws, rules, regulations, 
and/or procedures prohibiting the unauthorized disclosure or retention of 


classified and/or national defense information; | 
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g. All records or information related to any communications from June 2012 to 
the present between a. and any other person suncerntng ongoing 
law enforcement investigations; 

h All records or information concerning any email accounts, telephone sabes 
or other methods of communication used by MS or Petracus; 

i. Any information recording J[or Petraeus’s schedule or travel 
from December 2008 to the present; and 

j. Records evidencing the use-of the Internet, including records of Internet 


Protocol addresses used; 


2. As used above, the terms “records” and “information” include all of the foregoing 
~ items of evidence in whatever form and by whatever means they may have been 
created or stored, including any form of computer or electronic storage (such as flash 


memory or other media that can store data) and any photographic form. 
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UNITED STATES DISTRICT COURT FOR THE 
WESTERN DISTRICT OF NORTH CAROLINA 


CHARLOTTE DIVISION | 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-244 | 
Vv. ORDER TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF AND APPLICATION 


EMAIL ACCOUNT AS DESCRIBED IN 
AFFIDAVIT AND ATTACHMENT, 
INCORPORATED HEREIN. 


) 

) 

) 

) 

CONTENT AND FORENSIC IMAGES OF 
) 

) 

UPON MOTION of the United States of America, by and through Jill Westmoreland 

Rose, United States Attorney for the Western District of North Carolina, it appearing that on 


August 8, 2013, the Court issued a search warrant in the above-captioned case and placed under 


seal the warrant, the application for the warrant, and the affidavit in support of the application for 


the warrant; it further appearing that the government, after reviewing the materials in connection 
with pending Freedom of Information Act litigation in the United States Court for the District of 
Columbia, now seeks to unseal said documents, subject to redactions of personal identifying 
information, pursuant to Local Criminal Rule 49(B) of this Court (the search warrant materials, 
as redacted by the government are attached hereto), it is hereby 


ORDERED that the search warrant, application for search warrant, and affidavit in 


support of the application for the search warrant, as redacted by the government, are hereby 
UNSEALED. 

The Clerk is directed to certify copies of this Order to the United States Attorney's 
Office. | 


This the day of December, 2016. 


UNITED STATES MAGISTRATE JUDGE 
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FILED | 


CHARLOTTE, NC 
UNITED STATES DISTRICT COURT FOR THE 
WESTERN DISTRICT OF NORTH CAROLINA DEC 20 2016 
CHARLOTTE DIVISION 
US District Court 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-244Vestern District of NC 
) 
v. ) MOTION TO UNSEAL THE 
) SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF ° ) AND APPLICATION 
CONTENT AND FORENSIC IMAGES OF ) Pode oe 
EMAIL ACCOUNT AS DESCRIBED IN ) 
AFFIDAVIT AND ATTACHMENT, ) 
INCORPORATED HEREIN ) 


NOW COMES the United States of America, by and through Jill Westmoreland Rose, 

United States Attorney for the Western District of North Carolina, who respectfully shows unto | 
| 

the Court that on August 8, 2013, the court issued a search warrant in the above-captioned case | 
and placed under seal the warrant, the application for the warrant and the affidavit in support of | 
the application for the warrant; after reviewing the materials in connection with pending 
Freedom of Information Act litigation in the United States District Court for the District of 
Columbia, the United States now seeks to unseal said documents, subject to redactions of 
personal identifying information, pursuant to Local Criminal Rule 49(B) of this Court (the search 
warrant materials, as redacted by the government, are attached hereto). 

THEREFORE, the United States respectfully moves the Court for the search warrant, the 
application for the warrant, and the affidavit in support of the application for the warrant listed 
above be unsealed. 


Respectfully submitted, on this day of December 19, 2016. 


JILL WESTMORELAND ROSE | 
UNITED STATES ATTORNEY 


//s//11LL WESTMORELAND ROSE 


ASSISTANT UNITED STATES ATTORNEY 
NC Bar Number # 17656 
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Attorney for USA 
Carillon Bldg, Suite 1700 
227 West Trade Street 
Charlotte, NC 28202 
Phone: 704-344-6222 
Fax: 704-344-6629 


Email: jill.rose@usdoj.gov 
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UNITED STATES DISTRICT COURT FOR THE 


WESTERN DISTRICT OF NORTH CAROLINA 


CHARLOTTE DIVISION 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-244 
Vv. ORDER TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF AND APPLICATION 


EMAIL ACCOUNT AS DESCRIBED IN 
AFFIDAVIT AND ATTACHMENT, 


), 
) 
) 
CONTENT AND FORENSIC IMAGES OF 
) 
INCORPORATED HEREIN. ) 


UPON MOTION of the United States of America, by and through Jill Westmoreland 
Rose, United States Attorney for the Western District of North Carolina, it appearing that on 
August 8, 2013, the Court issued a search warrant in the above-captioned case and placed under 
seal the warrant, the application for the warrant, and the affidavit in support of the application for 
the warrant; it further appearing that the government, after reviewing the materials in connection 
with pending Freedom of Information Act litigation in the United States Court for the District of 
Columbia, now seeks to unseal said documents, subject to redactions of personal identifying 
information, pursuant to Local Criminal Rule 49(B) of this Court (the search warrant materials, 
as redacted by the government are attached hereto), it is hereby 

ORDERED that the search warrant, application for search warrant, and affidavit in 
support of the application for the search warrant, as redacted by the government, are hereby 
UNSEALED. 

The Clerk is directed to certify copies of this Order to the United States Attorney's 
Office. 

This the Re ay of December, 2016. 


VAC 


UNITED STATES MAGISTRATE JUDGE 
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4 AO 106 (Rev. 04/10) Application for a Search Warrant FI LED 


ere Ke 
UNITED STATES DISTRICT COURT 


AUG - 8 2013 
for the 
Western District of North Carolina US District Court 
Western District of NC 

In the Matter of the Search of ) 
(Briefly describe the property to be searched ) 

or identify the person by name and address) ) Case No. 
Content and forensic images of email account as ) 
described in Affidavit and Attachment, incorporated } 

herein. 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See attachment A, which is incorporated fully herein. 


located in the Western District of North Carolina , there is now concealed (identify the 
person or describe the property to be seized): 


See attachment B which is incorporated fully herein. 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
@ evidence of a crime; 
wo contraband, fruits of crime, or other items illegally possessed; 
01 property designed for use, intended for use, or used in committing a crime; 
0 aperson to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. 1924 Unauthorized removal and retention of classified documents and materials. 
18 U.S.C. 793(e) Unauthorized possession, communication and willful retention of national defense 
information 


The application is based on these facts: 


of Conginued on the attached sheet. 


0 Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


sy S| he rn 


Applicant's signature 


Raju S. Bhatia Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


se Ges as Wes 


City and state: Charlotte, North Carolina Robert J. Conrad, Jr., United States District Court Judge 


Printed name and title 


Judge's signature 
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AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT. 


I, Raju S. Bhatia, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 


1, Imake this affidavit in support of an application for a search warrant for information 


associated with a certain account stored at premises owned, maintained, controlled, or 

operated by United States Central Command (US CENTCOM) headquartered at MacDill 

Air Force Base, Tampa, Florida. The information to be searched is described in the 

following paragraphs and in Attachment A, all incorporated fully by reference herein. 
2. Iam a Special Agent with the Federal Bureau of Investigation (FBI) and have been | 

employed as such for over 14 years. I have investigated matters involving complex | 

financial fraud, public corruption, organized crime, counterterrorism, and 


counterespionage. Iam currently assigned to the Charlotte, North Carolina FBI office. 


Through investigations, experience, and training, I have become familiar with methods | 
and operations employed by individuals attempting to conceal their illegal behavior. I 
have also received training in the proper collection, retention, and dissemination of 
classified information. 
3. The facts in this affidavit come from my personal observations, my training and 
experience, evidentiary review, and information obtained from other Agents, government 
officials, and witnesses. This affidavit is intended to show merely that there is sufficient 


probable cause for the requested warrant and does not set forth all of my knowledge 


about this matter. 
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STATUTORY AUTHORITY 
4. The FBI has been conducting an investigation of DAVID PETRAEUS and i <I 
a: possible violations of: (a) unauthorized removal and retention of 

classified documents and material, in violation of Title 18, United States Code, Section 
1924; (b) unauthorized possession and, inter alia, attempted communication and willful 
communication of national defense information to someone not entitled to receive it, as 
well as the willful retention of national defense information, in violation of Title 18, 
United States Code, Section 793(e); and (c) conspiracy to commit the aforementioned 
crimes, in violation of Title 18, United States Code, Section 371. 

5. For the reasons set forth below, there is probable cause to believe that the email account 


ees ‘described in detail in Attachment A) contains 


evidence, fruits, and/or instrumentalities of violations of federal law, including, inter alia, 


the improper communication and/or retention of classified information. 
6. Title 18, United States Code, Section 1924(a) states: 


Whoever, being an officer, employee, contractor, or consultant of the United 
States, and, by virtue of his office, employment, position, or contract, becomes 
possessed of documents or materials containing classified information of the 
United States, knowingly removes such documents or materials without authority 
and with the intent to retain such documents or materials at an unauthorized 
location shall be fined under this title or imprisoned for not more than one year, or 
both. 


18 U.S.C. § 1924(a). 
7. Title 18, United States Code, Section 793(e) states: 


Whoever having unauthorized possession of, access to, or control over any 
document, writing, code book, signal book, sketch, photograph, photographic 
negative, blueprint plan, map, model, instrument, appliance, or note relating to the 
national defense, or information relating to the national defense which 
information the possessor has reason to believe could be used to the injury of the 
United States or to the advantage of any foreign nation, willfully communicates, 
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delivers, transmits or causes to be communicated, delivered, or transmitted, or 
attempts to communicate, deliver, transmit or cause to be communicated, 
delivered, or transmitted the same to any person not entitled to receive it, or 
willfully retains the same and fails to deliver it to the officer or employee of the 
United States entitled to receive it... shall be fined under this title or imprisoned 
not more than ten years or both. 


18 U.S.C. § 793(e). 
8, Title 18, United States Code, Section 371, makes punishable, by up to five years in 
prison, a conspiracy among two or more persons to commit any offense against the 


United States. 


9. Classified information is defined by Executive Order 13526 (E.O. 13526) and relevant 
preceding Executive Orders, as information in any form that: (1) is owned by, produced 
by or for, or under the control of the United States government; (2) falls within one or | 
more of the categories set forth in the E.O. 13526; and (3) is classified by an original 
classification authority who determines that its sanatithorosd disclosure reasonably could | 
be expected to result in damage to the national security. Where such unauthorized | 
disclosure reasonably could be expected to cause “damage” to the national security, the 
information is classified as “Confidential.” Where such unauthorized disclosure | 


reasonably could be expected to cause “serious damage” to the national security, the 


information is classified as “Secret.” Where such unauthorized disclosure reasonably 
could be expected to cause “exceptionally grave damage” to the national security, the 
information is classified as “Top Secret.” 


10. Pursuant to E.O. 13526, a person may only gain access to classified information if a 


favorable determination of eligibility for access has been made by an’agency head or an 
agency head’s designee, the person has signed an approved nondisclosure agreement, and 


the person has a need-to-know the information. 
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PROBABLE CAUSE 

11. PETRAEUS is a retired United States Army General. From on or about October 31, 
2008 to June 30, 2010, PETRAEUS served as Commander of the United States Central 
Command. From on or about June 23, 2010 to July 18, 2011, PETRAEUS served as 
Commander of the International Security Assistance Force, From on or about September 
6, 2011 to November 9, 2012, PETRAEUS served as Director of the Central Intelligence 
Agency (CIA). At all times relevant to this affidavit, PETRAEUS held a United States 
government security clearance allowing him access to classified United States 
government information. To obtain that clearance, PETRAEUS was required to and 
would have agreed to properly protect classified information by not disclosing such 
information to persons not entitled to sees it, by not unlawfully erates classified 
information from authorized storage facilities, and by not storing classified information in 
unauthorized locations. 

12. ifaw is a researcher and author of a biography of PETRAEUS, published in 
January 2012. From on or about July 18, 2003 until on or about November 14, 2012, 
FP held a United States government security clearance allowing her access 

* to classified United States government information. To obtain that clearance, 

HR was required to and would have agreed to properly protect classified 
information by not disclosing such information to persons not entitled to receive it, by not 
unlawfully removing classified information from authorized storage facilities, and by not 
storing classified information in unauthorized locations. 

13. In June 2012, the FBI’s Tampa Division (FBI Tampa) opened a computer intrusion 


investigation related to alleged cyber stalking activity. This investigation was predicated 
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14, 


15. 


on a complaint received from Witness 1, which alleged the receipt of threatening and 
harassing emails. Witness 1 claimed friendships with several high-ranking public and 
military officials. 

Evidence gathered during the FB] Tampa investigation indicated that someone had access 
to the personal schedule of PETRAEUS, who was then the Director of the CIA. This 
access indicated a potential breach of security. On or about June 22, 2012, FBI 
Headquarters (FBIHQ) notified PETRAEUS’s security detail of the ongoing computer 
intrusion investigation and the potential security issue. On July 19, 2012, FBI Tampa 
was notified by Witness 1 that he/she-no longer wished to press charges against the cyber 
stalker. On August 10, 2012, Witness 1 informed FBI Tampa that PETRAEUS 
personally requested that Witness 1 withdraw his/her complaint and “call off the G-men.” 
On August 13, 2012, Witness 1 advised FBI Tampa that PETRAEUS believed the . 
alleged cyber stalker possessed information which could “embarrass” PETRAEUS and 
other public officials. Ultimately the FBI determined, based upon. the investigation, that 
ae the individual who had sent the emails to Witness 1. 

‘On September 24, 2012 as part of the FBI Tampa investigation, yy 
consented to a search of two laptops and two external hard drives belonging to her. A 
review of the digital media contained on these devices revealed over 100 items which 
were identified by Charlotte Computer Analysis Response Team (CART) Forensic 


Examiners as potentially containing classified information, up to the Secret level. 


16. On October 26, 2012, PETRAEUS was interviewed at CIA Headquarters. PETRAEUS 


stated that he had had an extramarital affair with a. He denied providing 


any classified documents to hin == =] or having any arrangement to provide her 


Case 3:13-mj-00244-RJC *SEALED* Document 4 Filed 12/20/16 Page 6 of 20 


with classified information. PETRAEUS stated that I may have obtained 
documents in the course of conducting research for a book she was writing. He explained 
that reporters in theater (Afghanistan), such as a. were sometimes granted 
“off-the-record” access to classified presentations, such as the COMISAF’s (Commander, 
International Security Assistance Force) daily briefings. 

17. On November 2, 2012, FBI Tampa interviewed a. in Charlotte, North 
Carolina regarding the potentially classified documents found on her computers. She 
claimed she came into possession of several of the documents when she was in 
Afghanistan researching her book about PETRAEUS; however, she was unable to 
provide specifics as to how she obtained them. ea stated that during her 
time in Afghanistan she was given access to several briefings, including at least one 
briefing at the Secret level. SS advised that reporters were often given such 
access in order to provide them with situational awareness of the war. In order to receive 
the briefings, a. signed an “off-the-record” agreement, which meant she 
could not write about classified information she observed. She stated she would 
sometimes obtain a paper copy of the briefings to preserve the information as research for 
her book. asa advised that she never received classified information from 
PETRAEUS. 


18. During interviews conducted of [REMY and PETRAEUS under the 


o 


aforementioned FBI Tampa investigation, each advised they used covert methods to 
communicate with each other. These methods included the use of pre-paid cellular 
telephones and email accounts using non-attributable names. Several of these covert 


email accounts were identified during the FBI Tampa investigation; however, it is not 


Case 3:13-mj-00244-RJC *SEALED* Document 4 Filed 12/20/16 Page 7 of 20 


19. 


20. 


21. 


known if all the accounts were identified because both I. and PETRAEUS 
stated they could not recall all the account names which they created and used to 
communicate. During Po September 25, 2012 interview, she advised that 
she and PETRAEUS would sometimes share the same account, and would save messages 
to the draft folder instead of sending them via email. 

On November 12, 2012, Agents from the Charlotte and Tampa Divisions of the FBI 
participated in a consensual search of HR «csidence in SH North 
Carolina to recover any evidence related to cyber stalking, a violation of 18 U.S.C. 

§ 2261A, and the unauthorized removal and retention of classified documents, a violation 
of 18 U.S.C. § 1924. During the search, numerous items were seized to include digital 
media as well as four boxes and one folder of documents. On this same date, 
HES administrative assistant voluntarily provided the FBI with digital media 
as well as one box of documents which she maintained in her home in relation to her 
employment with EE... A review of the seized materials has identified to date 
hundreds of potentially classified documents, including more than 300 marked Secret, on 
digital images maintained on various pieces of electronic media. 

Of the potentially classified documents reviewed to date, the majority relate to U.S. 
military operations conducted in Afghanistan. EE 2vcicd into and out of 
Afghanistan several times between September 2010 and July 2011 to conduct research 
for a biography on PETRAEUS. During this time, PETRAEUS was serving as the 
International Security Assistance Force (ISAF) Commander. 


= paper documents, digital data, and audio files indicate PETRAEUS 


played an integral role in granting + 2 access to classified information for the 
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purpose of writing his biography. For example, in an email! dated January 16, 2011, 
which PETRAEUS marked as CONFIDENTIAL and sent to multiple members of the 


military, he instructed a member of his staff to “PLS PRINT FOR EEE, ON AN 


OFF THE RECORD BASIS.” Travel documents show that I was in 
Afghanistan at this time. 


‘A. Communications Regarding Potential Mishandling of Classified 
Information { 


22. On May 12, 2011, EE. using email account ay 


sent an email to PETRAEUS at email account 
Sas . The subject line of the email read: “what part of 

4...” and the body of the email read: “is secret? The stuff in parenthesis or the second | 
sentence?” Based on my training, experience, and information reviewed to date in this 
investigation, the email related to a document or series of documents provided by 
PETRAEUS to RB which contained classified information. 

23. Between July 13, 2011 and July 15, 2011, MY and a U.S: Army Licutenant 
Colonel exchanged numerous emails. a. using email account 


GE 210210 the Licutenant Colonel at his military email 


account, seeking information about military operations conducted by the Lieutenant 


Colonel’s unit. In requesting this information, noted that in the past both 


storyboards and troop narratives had been useful in conveying such facts. In an email 


from the Lieutenant Colonel to a on July 15, 2011, he advised he was 
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24. 


working on the storyboards and asked her for “a good SIPR number.”! 


Later on July 15, 
2011, [NY replied to the Lieutenant Colonel’s email and carbon copied (cc’d) 
PETRAEUS at email account SS = —a 
response included the following: “[I]f you have classified material, GEN Petraeus has 
been gracious enough to allow me to have you send the storyboards and material to his 
SIPR account; I’1l pick them up as soon as you send the word! I’ve copied him on this 
email. If it’s unclass, you can use my AKO or this account.” This email correspondence 
between [EE and the Licutenant Colonel reflects some agreement by 
PETRAEUS to provide FY access to classified information. 


From June 12, 2011 through June 15, 2011, ME, using email address 


ee 22.0 PETRAEUS, using email address 
=| , discussed several topics, to include files 


maintained by PETRAEUS. In the email string, which contained the subject line 
“Chapter 2,” ME. raised issues which PETRAEUS addressed by typing in all 
capital letters within the body of ei ginal emails. In the email string, 
while discussing PETRAEUS’s files, HE rote, “[T]he Galvin letters are 
naturally very helpful in this regard (I want more of them!!! I know you’re holding 
back...)” In response to this point iii email, PETRAEUS wrote: 
“THEY’RE IN BOXES AND I’LL GET THEM OUT WHEN WE UNPACK AT THE 


HOUSE IN LATE JULY/AUG.” 


 SIPR is an acronym for Secure Internet Protocol Router network, a U.S. government 
communications system allowing the processing, storage, and communication of classified 
information up to the SECRET level. 
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25, ER responded: “Thanks for your willingness to get out the boxes! Susan 
Lemke, the librarian at NDU, has the full collection as well, if it’s easier to just gain 
access to them there.”? In response, PETRAEUS wrote: “SHE DOESN’T HAVE THE 
FILES I’ VE GOT AT HOME; NEVER GAVE THEM TO HER.” 


26. In an email string initiated on or about June 19, 2011, PETRAEUS, using email address 


= oe and MS, using email address 
ee | exchanged over ten emails. In the first email, with the 
subject line “Found the”, PETRAEUS discussed locating his “Galvin files” as well as 

: othe files and expressed his willingness to share them with [iy 
PETRAEUS wrote: “[G]Jiven various reassurances from a certain researcher, I will not 
triage them!” Your Affiant believes the term “triage” refers to the classified contents of 
the documents. | expressed her excitement about PETRAEUS’s 
willingness to share the files writing: “{I]’ll protect them. And I'll protect you.” 
PETRAEUS later responded to a. writing, “[Mly files at home only go up 
to about when I took cmd of the 101", though there may be some MNSTC-I and other 
ones. Somewhere in 2003, I stopped nice filing and just started chunking stuff in boxes 
that gradually have gone, or will go, to NDU. Can search them at some point if they’re 
upstairs, but they’re not organized enough at this point. .3- PETRAEUS continued, 


writing, “[A]nd I think MNSTC-I files went to NDU, though I’m not sure. The key to 


* NDU is an acronym for National Defense University. NDU is an institution of higher education 
funded by the United Stated Department of Defense, intended to facilitate high-level training, 
education, and the development of national security strategy. It is located on the grounds of Fort 
Lesley McNair in Washington, D.C. 

*?MNSTC-1 is an acronym for Multi-National Security Transition Command-Iraq. MNSTC-I 
was a branch of the Multi-National Force-Iraq (MNF-I). Petraeus was the former commander of 
MNF-I. 
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find there would be the weekly reports that the CIG did with me. Not sure if | | kept 
copies. Class’d, but I guess I might share!” (Emphasis added). 

27. Your affiant believes that PETRAEUS’s reference to “Class’d” means the documents he 
is discussing --- and which he indicates he is willing to provide to I --- arc 
classified. 

28. Based on these facts, there is probable cause to believe that PETRAEUS’s email account, 

=e , contains substantive communications regarding 
PETRAEUS’s hain of classified information as well as == access to and 
retention of classified information. 
BACKGROUND CONCERNING EMAIL 

29. In my training and experience, I have learned that US CENTCOM provides electronic 
mail (“email”) access to uniformed and civilian employees. These users are provided an 
email account for use in their official duties. Consequently, US CENTCOM computers 
are likely to contain stored electronic communications (including retrieved and 
unretrieved email for US CENTCOM users) and information concerning users and their 
use of US CENTCOM services. This information would include details regarding users 
of US CENTCOM service, such as the user’s full name, physical locations, telephone 
numbers and other identifiers, account access information, email transaction information, 
and alternative email addresses. In my training and experience, such information may 
constitute evidence of the crimes under investigation because the information can be used 
to identify the account’s user or users. 

30. In general, an email that is sent to a CENTCOM subscriber is stored in the subscriber’s 


“mail box” on CENTCOM servers until the subscriber deletes the email. If the 


11 
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subscriber does not delete the message, the message can remain on CENTCOM servers 
indefinitely. 


3 


— 


. When the subscriber sends an email, it is initiated at the user’s computer, transferred via 
the Internet to CENTCOM servers, and then transmitted to its end destination. 
CENTCOM often saves a copy of the email sent. Unless the sender of the email 
specifically deletes the email from the CENTCOM server, the email can remain on the 
system indefinitely. 

32. A CENTCOM subscriber can also store files, including emails, files and other data, on 

servers maintained and/or owned by CENTCOM. 

33. Subscribers to CENTCOM might not store, on their home computers, copies of the 
emails stored in their CENTCOM account. This is particularly true when the subscriber 
accesses their CENTCOM account through the web, or if they do not maintain particular 
emails or files in their residence or on their home computer. 

34. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This 
information can ‘nae the date on which the account was created, the length of service, 
records of log-in (i.e., session) times and durations, the types of service utilized, the 
status of the account (including whether the account is inactive or closed), the methods 

_used to connect to the account (such as logging into the account via the provider's 
website), and other log files that reflect usage of the account. In addition, email providers 
often have records of the Internet Protocol address (“IP address”) used to register the 
account and the IP addresses associated with particular logins to the account. Because 


every device that connects to the Internet must use an IP address, IP address information 
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can help to identify which computers or other devices were used to access the email 
account. 

35. In my training and experience, in some cases email account users will communicate 
directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers 
typically retain records about such communications, including records of contacts 

" between the user and the provider’s support services, as well records of any actions taken 
by the provider or user as a result of the communications. Such information may 
constitute evidence of the crimes under investigation because the information can be used 
to identify the account’s user or users. 

LOCATION TO BE SEARCHED 

36. I anticipate executing this warrant under the Electronic Communications Privacy Act, in 
particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A), by using the 
requested warrant to require US CENTCOM to disclose to the government copies of the 
records and other information (including the content of communications) particularly 
described in Attachment A. Upon receipt of the information described in Attachment A, 
the information described in Attachment B will be subject to seizure by law enforcement. 

37. Based upon the foregoing, your affiant submits that probable cause exists for the issuance 
of a search warrant for information associated with a certain account, as more fully 
described in Attachment A to this affidavit, stored at premises owned, maintained, 
controlled, or operated by US CENTCOM, headquartered at MacDill Air Force Base, 
Tampa, Florida, to search for evidence of: (a) unauthorized removal and retention of 


classified documents and material, in violation of 18 U.S.C. § 1924; (b) unauthorized 


13 
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38. 


possession and, inter alia, attempted communication and willful communication of 


national defense information to someone not entitled to receive it, as well as the willful 
retention of national defense information, in violation of 18 U.S.C. § 793(e); and (c) 


conspiracy to commit the aforementioned crimes, in violation of 18 U.S.C. § 371. 


CONCLUSION 
Based on my training and experience, and the facts as set forth in this affidavit, your 


affiant asserts there is probable cause to believe that stored in the email account, 


Po , there exists evidence of a crime relating to: (a) 


39. 


40. 


unauthorized removal and retention of classified documents and material, in violation of 


18 U.S.C. § 1924; (b) unauthorized possession and, inter alia, attempted communication 


and willful! communication of national defense information to someone not entitled to 
receive it, as well as the willful retention of national defense information, in violation of 
18 U.S.C. § 793(e); and (c) conspiracy to commit the aforementioned crimes, in violation 
of 18 U.S.C. § 371. 

Based on the foregoing, I request that the Court issue the requested search warrant. 
Because the warrant will be served on US CENTCOM, who will then compile the 
requested records at a time convenient to it, there exists reasonable cause to permit the 
execution of the requested warrant at any time in the day or night. 

This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by Title 18, United States Code, Section 2711; and 
Title 18, United States Code, Sections 2703(a), (b)(1)(A), and (c)(1)(A). Specifically, the 


Court is “a district court of the United States that has jurisdiction over the offenses being 
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investigated,” Title 18, United States Code, Sections 1924, 793(e), and 371. Pursuant to 
Title 18, United States Code, Section 2703(g), the presence of a law enforcement officer 


is not required for the service or execution of this warrant. 


REQUEST FOR SEALING 
4 


— 


. Since this investigation is continuing, disclosure of the search warrant, this affidavit, 
and/or this application and the attachments thereto will jeopardize the progress of the 
investigation. Accordingly, it is respectfully requested that the Court issue an order that 
the search warrant, this affidavit in support of the application for search warrant, the 
application for search warrant, and al] attachments thereto be filed under seal until further 
order of this Court. 


Respectfully submitted, 


“eae GO. heute 
Raju S. Bhatia 
Special Agent 
Federal Bureau of Investigation 


Sworn to and subscribed before me 
on this, the g te day of August, 2013. 


Geko We O pret’ 
OBERT J. COMRAD, JR. 


UNITED STATES DISTRICT COURT a GE 
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ATTACHMENT A 


Particular Account To Be Searched 


This warrant applies to records and other information (including the contents of “ae 


communications) for the account associated with the email address 


a that is stored at premises controlled by US Central 


Command, which accepts service of legal process at MacDill Air Force Base, Tampa, Florida. 
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ATTACHMENT B 
Particular Things To Be Seized 
I. Information To Be Disclosed by CENTCOM (“the Provider”) 

To the extent that the information described in Attachment A is within the 
possession, custody, or control of the Provider, including any emails, records, files, logs, or 
information that has been deleted but is still available to the Provider, the Provider is required to 
disclose the following information to the government for the account listed in Aitechruenit A: 

a. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account, draft emails, the source and destination 
addresses associated with each email, the date and time at which each email was sent, and the 
size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical sakes telephone numbers and other identifiers, records of session 
times and durations, the date on which the account was created, the length of service, the IP 
address used to register the account, log-in IP addresses associated with session times and dates, 


account status, alternative email addresses provided during registration, methods of connecting, 


and log files; 


C. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, and files; and 
d. All records pertaining to communications between the Provider and any person 


regarding the account, including contacts with support services and records of actions taken. 
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114 Information To Be Seized by the Government 
1. All records or information described above in Section I that constitute fruits, 
evidence, and instrumentalities of violations of the statutes listed on the warrant, 
including, for the account identified on Attachment A: 

a. All records or information related to any communications between 
PETRAEUS and a; 

b. All records or information related to any communications, from December 
2008 to the present, between PETRAEUS and any other person or entity 
concerning classified and/or national defense information; 

c. All records or information, from December 2008 to the present, related to any 
classified and/or national defense information; 

d. All records or information, from December 2008 to the present, related to the 
source(s) or potential source(s) of any classified and/or national defense 
information provided by PETRAEUS to a; 

e. All records or information, from December 2008 to the present, related to the 
state of mind of any individuals concerning the communication, disclosure, 
receipt, or retention of classified and/or national defense information; 

f. All records or information relating to knowledge of laws, rules, regulations, 
and/or procedures prohibiting the unauthorized disclosure or retention of 
classified and/or national defense information; 

g. All records or information related to any communications from June 2012 to 
the present between PETRAEUS and any other person concerning ongoing 


law enforcement investigations; 
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h. All records or information concerning any email accounts, telephone numbers, 
or other methods of communication used by PETRAEUS or a. 
i. Any information recording PETRAEUS’s or aan schedule or 
travel from December 2008 to the present; 
and 
j. Records evidencing the use of the Internet, including records of Internet 
Protocol addresses used; 
2: internation relating to who created, used, or communicated with the account, 
including records about their identities and whereabouts. 
3. As used above, the terms “records” and “information” include all of the foregoing 
items of evidence in whatever form and by whatever means they may have been 
created or stored, including any form of computer or electronic storage (such as flash 


memory or other media that can store data) and any photographic form. 
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UNITED STATES DISTRICT COURT FOR THE 
WESTERN DISTRICT OF NORTH CAROLINA 


CHARLOTTE DIVISION 
UNITED STATES OF AMERICA ) DOCKET NO.:  3:13-mj-246 
v. MOTION TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF AND APPLICATION 


EMAIL ACCOUNT AS DESCRIBED IN 
AFFIDAVIT AND ATTACHMENT, 


) 
) 
) 
CONTENT AND FORENSIC IMAGES OF 
) 
INCORPORATED HEREIN. ) 


NOW COMES the United States of America, by and through Jill Westmoreland Rose, 
United States Attorney for the Western District of North Carolina, who respectfully shows unto 
the Court that on August 8, 2013, the court issued a search saan in the sicnaeadiboned case 
and placed under seal the warrant, the application for the warrant and the affidavit in support of 
the application for the warrant; after reviewing the materials in connection with pending 
Freedom of Information Act litigation in the United States District Court for the District of 
Columbia, the United States now seeks to unseal said documents, subject to redactions of 
personal identifying information, pursuant to Local Criminal Rule 49(B) of this Court (the search 
warrant materials, as redacted by the government, are attached hereto). 

THEREFORE, the United States respectfully moves the Court for the search warrant, the 
application for the warrant, and the affidavit in support of the application for the warrant listed 
above be unsealed. 

Respectfully submitted, on this day of December 19, 2016. 


JILL WESTMORELAND ROSE 
UNITED STATES ATTORNEY 


/s//1LL WESTMORELAND ROSE 


ASSISTANT UNITED STATES ATTORNEY 
NC Bar Number # 17656 
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Attorney for USA 
Carillon Bidg, Suite 1700 
227 West Trade Street 
Charlotte, NC 28202 
Phone: 704-344-6222 
Fax: 704-344-6629 


Email: jill.rose@usdoj.gov 
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UNITED STATES DISTRICT COURT FOR THE es Me ba 


Phy Be 
WESTERN-DISFRICT-OF NORTH-CAROEINA 


CHARLOTTE DIVISION DEC 2 6 204 


UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-246. 008i (2, 
v. ORDER TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF AND APPLICATION 


‘EMAIL ACCOUNT AS DESCRIBED IN 
AFFIDAVIT AND ATTACHMENT, 


) 
) 
) 
CONTENT AND FORENSIC IMAGES OF ; 
) 
INCORPORATED HEREIN. ) 


UPON MOTION of the United States of America, by and through Jill Westmoreland 
Rose, United States Attorney for the Western District of North Carolina, it appearing that on 
August 8, 2013, the Court issued a search warrant in the above-captioned case and placed under 
seal the warrant, the application for the warrant, and the affidavit in support of the application for 
the warrant; it further appearing that the government, after reviewing the materials in connection 
with pending Freedom of Information Act litigation in the United States Court for the District of 
Columbia, now seeks to unseal said documents, subject to redactions of personal identifying 
information, pursuant to Local Criminal Rule 49(B) of this Court (the search warrant materials, 
as redacted by the government are attached hereto), it is hereby 

ORDERED that the search warrant, application for search warrant, and affidavit in 
support of the application for the search warrant, as redacted by the government, are hereby 
UNSEALED. 

| The Clerk is directed to certify copies of this Order to the United States Attorney's 

Office. 


This the a) y day of December, 2016. 


( od My ae 
UNITED STATES MAGISTRATE J E 
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. i 
’ AO 106 (Rev. 04/10) Application for a Search Warrant Fi ED 
, 


UNITED STATES DISTRICT COURT ij 
for the ~8 2013 
Western District of North Carolina US D istrict Gaur 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person isd name and address) 


Case No. 


Content and forensic images of email account as 
described in Affidavit and Attachment, incorporated 
herein. 


~eeSeSmeeSmeE 


APPLICATION FOR A SEARCH WARRANT 


I, a federal Jaw enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See attachment A, which is incorporated fully herein. 


located in the Western District of North Carolina , there is now concealed (identify the 
person or describe the property to be seized): 


See attachment B which is incorporated fully herein. 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
© evidence of a crime; 
M contraband, fruits of crime, or other items illegally possessed; 
C property designed for use, intended for use, or used in committing a crime; 


C0 a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. 1924 Unauthorized removal and retention of classified documents and materials. 
18 U.S.C. 793(e) Unauthorized possession, communication and willful retention of national defense 
information 


The application is based on these facts: 


rf Continued on the attached sheet. 


‘CO Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Taye Ser Sha 


Applicant's signature 


Raju S. Bhatia Special Agent, FBI 
Printed name and title 


Sworn to before me and signed in my presence. 


Date: G S 13 


City and state: Charlotte, North Carolina Robert J, Conrad) Jr., United States District Court Judge 


Printed name and title 


Judge's signature 
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estern District of NC 


AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT 


I, Raju S Bhatia, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 
I make this affidavit in support of an application for a search warrant for information 
associated with a certain email account stored at premises owned, maintained, controlled, 
or operated by United States Central Command (US CENTCOM) headquartered at 
MacDill Air Force Base, Tampa, Florida. The information to be searched is described in 


the following paragraphs and in Attachment A, all incorporated fully by reference herein. 


. Tama Special Agent with the Federal Bureau of Investigation (FBI) and have been 


employed as such for over 14 years. I have investigated matters involving complex 
financial fraud, public corruption, organized crime, counterterrorism, and 
counterespionage. I am currently assigned to the Charlotte, North Carolina FBI office. 
Through investigations, experience, and training, I have become familiar with methods 
and operations employed by individuals attempting to conceal their illegal behavior. I 
have also received training in the proper collection, retention, and dissemination of 


classified information. 


. The facts in this affidavit come from my personal observations, my training and 


experience, evidentiary review, and information obtained from other Agents, government 
officials, and witnesses. This affidavit is intended to show merely that there is sufficient 
probable cause for the requested warrant and does not set forth all of my knowledge 


about this matter. 
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STATUTORY AUTHORITY 

4. The FBI has been conducting an investigation of DAVID PETRAEUS and 
HEE £0: possible violations of: (a) unauthorized removal and retention of 
classified documents and material, in violation of Title 18, United States Code, Section | 
1924; (b) unauthorized possession and, inter alia, attempted communication and wiilful 
communication of national defense information to someone not entitled to receive it, as 
well as the willful retention of national defense information, in violation of Title 18, 
United States Code, Section 793(e); and (c) conspiracy to commit the aforementioned 
crimes, in violation of Title 18, United States Code, Section 371. 

5. For the reasons set forth below, there is probable cause to believe that the email account 

ee (described in detail in Attachment A) contains evidence, 

fruits, and/or instrumentalities of violations of federal law, including, inter alia, the 


improper communication and/or retention of classified information. 


6. Title 18, United States Code, Section 1924(a) states: 


Whoever, being an officer, employee, contractor, or consultant of the United 

States, and, by virtue of his office, employment, position, or contract, becomes ; 
possessed of documents or materials containing classified information of the I: 
United States, knowingly removes such documents or materials without authority | 
and with the intent to retain such documents or materials at an unauthorized : 
location shall be fined under this title or imprisoned for not more than one year, or 
both. i 


18 U.S.C. § 1924(a). | 


7. Title 18, United States Code, Section 793(e) states: 


Whoever having unauthorized possession of, access to, or control over any 
document, writing, code book, signal book, sketch, photograph, photographic 
negative, blueprint plan, map, model, instrument, appliance, or note relating to the 
national defense, or information relating to the national defense which 
information the possessor has reason to believe could be used to the injury of the 
United States or to the advantage of any foreign nation, willfully communicates, 
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10. 


delivers, transmits or causes to be communicated, delivered, or transmitted, or 
attempts to communicate, deliver, transmit or cause to be communicated, 
delivered, or transmitted the same to any person not entitled to receive it, or 
willfully retains the same and fails to deliver it to the officer or employee of the 
United States entitled to receive it . . . shall be fined under this title or imprisoned 
not more than ten years or both. 
18 U.S.C. § 793(e). 
Title 18, United States Code, Section 371, makes punishable, by up to five years in 
prison, a conspiracy among two or more persons to commit any offense against the 
United States. 
Classified information is defined by Executive Order 13526 (E.O. 13526) and relevant 
preceding Executive Orders, as information in any form that: (1) is owned by, produced 
by or for, or under the control of the United States government; (2) falls within one or 
more of the categories set forth in the E.O. 13526; and (3) is classified by an original 
classification authority who determines that its unauthorized disclosure reasonably could 
be expected to result in damage to the national security. Where such unauthorized 
disclosure reasonably could be expected to cause “damage” to the national security, the 
information is classified as “Confidential.” Where such unauthorized disclosure 
reasonably could be expected to cause “serious damage” to the national security, the 
information is classified as “Secret.” Where such unauthorized disclosure reasonably 
could be expected to cause “exceptionally grave damage” to the national security, the 
information is classified as “Top Secret.” 
Pursuant to E.O. 13526, a person may only gain access to classified information if a 
favorable determination of eligibility for access has been made by an agency head or an 


agency head’s designee, the person has signed an approved nondisclosure agreement, and 


the person has a need-to-know the information. 


Case 3:13-mj-00246-RJC *SEALED* Document 4-1 Filed 12/20/16 Page 3 of 19 


PROBABLE CAUSE 


11. PETRAEUS is a retired United States Army General. From on or about October 31, 


2008 to June 30, 2010, PETRAEUS served as Commander of the United States Central 
Command. From on or about June 23, 2010 to July 18, 2011, PETRAEUS served as 
Commander of the International Security Assistance Force. From on or about September 
6, 2011 to November 9, 2012, PETRAEUS served as Director of the Central Intelligence 
Agency (CIA). At all times relevant to this affidavit, PETRAEUS held a United States 
government security clearance allowing him access to classified United States 
government information. To obtain that clearance, PETRAEUS was required to and 
would have agreed to properly protect classified information by not disclosing such 
information to persons not entitled to receive it, by not unlawfully removing classified 
information from authorized storage facilities, and by not storing classified information in 


unauthorized locations. 


12. BE is a researcher and author of a biography of PETRAEUS, published in 


1 


Ww 


January 2012. From on or about July 18, 2003 until on or about November 14, 2012, 
[= = —_ ih held a United States government security clearance allowing her access 
to classified United States government information. To obtain that clearance, 

a 2s required to and would have agreed to properly protect classified 
information by not disclosing such information to persons not entitled to receive it, by not 
unlawfully removing classified information from authorized storage facilities, and by not 


storing classified information in unauthorized locations. 


. In June 2012, the FBI’s Tampa Division (FBI Tampa) opened a computer intrusion 


investigation related to alleged cyber stalking activity. This investigation was predicated 
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on acomplaint received from Witness 1, which alleged the receipt of threatening and 

harassing. Witness 1 claimed friendships with several high-ranking public and military 

officials. 
14. Evidence gathered during the FBI Tampa investigation indicated that someone had access 

to the personal schedule of PETRAEUS, who was then the Director of the CIA. This 

access indicated a potential breach of security. On or about June 22, 2012, FBI 


Headquarters (FBIHQ) notified PETRAEUS’s security detail of the ongoing computer 


intrusion investigation and the potential security issue. On July 19, 2012, FBI Tampa 
was notified by Witness 1 that he/she no longer wished to press charges against the cyber 
stalker. On August 10, 2012, Witness } informed FBI Tampa that PETRAEUS | 
personally requested that Witness 1 withdraw his/her complaint and “call off the G-men.” | 
On August 13, 2012, Witness 1 advised FBI Tampa that PETRAEUS believed the 
alleged cyber stalker possessed information which could “embarrass” PETRAEUS and 
other public officials. Ultimately the FBI determined, based upon the investigation, that 
——— was the individual who had sent the emails to Witness 1. 


15. On September 24, 2012 as part of the FBI Tampa investigation, 


consented to a search of two laptops and two external hard drives belonging to her. A | 
review of the digital media contained on these devices revealed over 100-items which 
—_ identified by Charlotte Computer Analysis Response Team (CART) Forensic 
Examiners as potentially containing classified information, up to the Secret level. 

16. On October 26, 2012, PETRAEUS was interviewed at CIA Headquarters. PETRAEUS 
stated that he had had an extramarital affair with MM. He denied providing 


any classified documents to | or having any arrangement to provide her 


| 
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with classified information. PETRAEUS stated that —— —— 5 may have obtained 
documents in the course of conducting research for a book she was writing. He explained 
that reporters in theater (Afghanistan), such as MEE , were sometimes granted 
“off-the-record” access to classified presentations, such as the COMISAF’s (Commander, 
International Security Assistance Force) daily briefings. 

17. On November 2, 2012, FBI Tampa interviewed I in Charlotte, North 
Carolina regarding the potentially classified documents found on her computers. She 
claimed she came into possession of several of the documents when she was in 
Afghanistan researching her book about PETRAEUS; however, she was unable to 


provide specifics as to how she obtained them. MMMM) stated that during her 


time in Afghanistan she was given access to several briefings, including at least one 
briefing at the Secret level. NE advised that reporters were often given such 
access in order to provide them with situational awareness of the war. In order to receive 
the briefings, MM signed an “off-the-record” agreement, which meant she 


could not write about classified information she observed. She stated she would 


sometimes obtain a paper copy of the briefings to preserve the information as research for | 
her book. (NM advised that she never received classified information from 
PETRAEUS. 

18. During interviews conducted of [NM and PETRAEUS under the 
aforementioned FBI Tampa investigation, each advised they used covert methods to 
communicate with each other. These methods included the use of email accounts using 


non-attributable names and pre-paid cellular telephones. Several of these covert email 


accounts were identified during the FBI Tampa investigation; however, it is not known if 
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19, 


20. 


all the accounts were identified because both ME and PETRAEUS stated 
they could not recall all the account names which they created and used to 

communicate. During Po September 25, 2012 interview, she advised that 
she and PETRAEUS would sometimes share the same account, and would save messages 
to the draft folder instead of sending them via email. 

On November 12, 2012, Agents from the Charlotte and Tampa Divisions of the FBI 
participated in a consensual search of (BENE residence in Charlotte, North 
Carolina to recover any evidence related to cyber stalking, a violation of 18 U.S.C. 

§ 22614, and the unauthorized removal and retention of classified documents, a violation 
of 18 U.S.C. § 1924. During the search, numerous items were seized to include digital 
media as well as four boxes and one folder of documents. On this same date, 
SS administrative assistant voluntarily provided the FBI with digital media 
as well as one box of documents which she maintained in her home in relation to her 
employment with J. A review of the seized materials has identified to date 
hundreds of potentially classified documents, including more than 300 marked Secret, on 
digital images maintained on various pieces of electronic media. 

Of the potentially classified documents reviewed to date, the majority relate to U.S. 
military operations conducted in Afghanistan, friveled into and out of 
Afghanistan several times between September 2010 and July 2011 to conduct research 
for a biography on PETRAEUS. During this time, PETRAEUS was serving as the 


International Security Assistance Force (SAF) Commander. 
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21. 


22. 


23. 


24. 


Se paper documents, digital data, and audio files indicate PETRAEUS 
played an integral role in granting as access to classified information for the 


purpose of writing his biography. 


A. Communications Regarding Potential Mishandling of Classified 
Information 


On December 29, 2009, PETRAUES, using email account 
sent an emai! to EM at email account i During a 


series of emails with the subject line, “Lincoln’s T-Mails?” PETRAUES wrote to 


i. “You’re pretty accurate! Off in the morning to Iraq, Sinai, and possibly 


the new focus of our attention...” Based on my training, experience, and information 
reviewed to date in this investigation, PETRAUES routinely provided aaa 
with his schedule and potentially classified operational plans. 

On January 14, 2010, i, using email account 
sent an email to PETRAEUS at email account The subject 
line of the email read: “Revolutions in Doctrine” and the body of the email read: “Thank 
you for this rich feedback. Again, I appreciate your candor! (Except when the off-the- 
record stuff is so important but I can’t use it for PC reasons...damn@)” 

On January 16, 2010, aaa. using email account 
sent an email to PETRAEUS at email account The body of 
the email read, ““GEN Petraeus, The research hat is back on! These attached are some 
good emails too. Mostly, all of these provide a wonderful timeline of key domestic and 
Iraq events and your associated sentiment at the time. Thank goodness and lucky me! 


Good see rapprochement between you and then candidate Obama. (I’m curious about 
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wn 


26. 


27. 


your promise to tell about the “one-on-one” discussion you had. Dare I ask?) “And 
I know enough to keep your discussions about politicians with ==) OTR... 
PETRAEUS replied toll “1°11 tell you my pull-aside with now POTUS 
someday. I owed it to him and was a bit astonished at the self-confidence of his reply- 


but also quite reassured.” 


On January 23, 2010, SEE, using email account Si 


sent an email to PETRAEUS at email account xy The body of 
the email read, “GEN Petraeus, Please tell me about your conversation with PM TB! © 
Best | Based on the investigation to date, “PM TB” is believed to be then-British 
Prime Minister Tony Blair. PETRAEUS replied to EE, “©” to which 


HE. wrote, “pretty please? ©” PETRAEUS responded, “Add it to the ‘over a 
beer’ list, pls. ma.” 

Based on my training, experience, and information reviewed to date in this investigation, 
the emails referenced in paragraphs 23, 24, and 25 demonstrate PETRAEUS’ willingness 
to provide sensitive information to [EE on an “off the ‘ear basis. 

On January 16, 2010, PETRAEUS, using email account 

forwarded an email to [EE at email account [IS 
The forwarded email stated, “JJ the exchanges you’ve had with [J reminded me of 
the courage you showed in writing your ‘strategic Op-Ed’ piece in July 07...I think you 
need to do another one today... The situation in Iraq has turned very serious in the past 
48-72 hours with the Accountability and Justice Commission (run by Faisal al-Lami, an 
Iranian controlled individual, who’s being guided by Ahmed Chalabi) recommending 


over 400 candidates for the Parliamentary Elections be disqualified...” PETRAEUS was 
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worried about the results of this process and its implications for Iraq. PETRAEUS 
continued, writing, “We need to galvanize national/world attention/pressure” and ended 


by saying “Pls protect your source as always. Best— Dave” In her response to 


PETRAEUS’ forwarded email, Lo] wrote, “He is flying to Florida today with 
his parents. ..I know I am nobody but let me know if I can help!” 

28. PETRAEIS followed up shortly with an email from his ae 
email account to a British political advisor at another CENTCOM-based email account. 
In the email to the British political advisor PETRAEUS wrote, “ok, please don’t betray 
my hand (act surprised with HM), but think this is a way of getting attention to this ; 
crisis. I shot up a big red star cluster on SIPR last night too. Got attention. Alerted WH | 
and SEN McCain, as well. Again, please don’t share with other than the big one (but tell 
him). We need to save our beloved land of the two rivers...” 

29, EE bad a copy of the email exchange referenced in paragraphs 27 and 28 in | 
her EE emai) account. Based on information reviewed to date 
in this investigation, it is believed that PETRAUES blind carbon copied (bec) 
ie on many of his email exchanges, and the email above appears to have 
been found in EEE Yahoo! Account because she was bec’d by PETRAEUS. 

30. Based on my training, experience, and information reviewed to date in this investigation, 
the emails referenced in paragraphs 27 and 28 demonstrate PETRAEUS’ willingness to 
share and provide access to sensitive and possibly classified material with 
a 

31. Based on these facts, and given PETRAEUS’s history of email communication with 


HE , there is probably cause to believe that PETRAEUS’s email account, 
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(|| , contains substantive communications regarding 
FY access to and retention of classified information. 


BACKGROUND CONCERNING EMAIL 

32. In my training and experience, I have learned that US CENTCOM provides electronic 
mail (“email”) access to uniformed and civilian employees. These users are provided an 
email account for use in their official duties. Consequently, US CENTCOM computers 
are likely to contain stored electronic communications (including retrieved and 
unretrieved email for US CENTCOM users) and information concerning users and their 
use of US CENTCOM services, This information would include details regarding users 
of US CENTCOM service, such as the user’s full name, physical locations, telephone 


numbers and other identifiers, account access information, email transaction information, 


and alternative email addresses. In my training and experience, such information may 


constitute evidence of the crimes under investigation because the information can be used 
to jdenkty the account’s user or users. 

33. In general, an email that is sent to a CENTCOM subscriber is stored in the subscriber’s 
“mail box” on CENTCOM servers until the subscriber deletes the email. If the 
subscriber does not delete the message, the message can remain on CENTCOM servers 
indefinitely. 


34. When the subscriber sends an email, it is initiated at the user’s computer, transferred via 


the Internet to CENTCOM servers, and then transmitted to its end destination. | 


CENTCOM often saves a copy of the email sent. Unless the sender of the email 
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35. 


36. 


37. 


38. 


specifically deletes the email from the CENTCOM server, the email can remain on the 
system indefinitely. 

A CENTCOM subscriber can also store files, including emails, files and other data, on 
servers maintained and/or owned by CENTCOM. 

Subscribers to CENTCOM might not store, on their home computers, copies of the 
emails stored in their CENTCOM account. This is particularly true when the subscriber 
accesses their CENTCOM account through the web, or if they do not maintain particular 
emails or files in their residence or on their home computer. 

In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems, This 
information can include the date on which the account was created, the length of service, 
records of log-in (i.e., session) times and durations, the types of service utilized, the 
status of the account (including whether the account is inactive or closed), the methods 
used to connect to the account (such as logging into the account via the provider's 
website), and other log files that reflect usage of the account. In addition, email providers 
often have records of the Internet Protocol address (“IP address”) used to register the 
account and the IP addresses associated with particular logins to the account. Because 
every device that connects to the Internet must use an IP address, IP address information 
can help to identify which computers or other devices were used to access the email 
account. 

In my training and experience, in some cases email account users will communicate 
directly with an email service provider about issues relating to the account, such as 


technical problems, billing inquiries, or complaints from other users. Email providers 
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39. 


40. 


typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well records of any actions taken 
by the provider or user as a result of the communications. Such information may 
constitute evidence of the crimes under investigation because the information can be used 
to identify the account’s user or users. 

LOCATION TO BE SEARCHED 
I anticipate executing this warrant under the Electronic Communications Privacy Act, in 
particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A), by using the 
requested warrant to require US CENTCOM to disclose to the government bevice of the 
records and other information (including the content of communications) particularly 
described in Attachment A. Upon receipt of the information described in Attachment A, 
the information described in Attachment B will be subject to seizure by law enforcement. 
Based upon the foregoing, your affiant submits that probable cause exists for the issuance 
of a search warrant for information associated with a certain account, as more fully 
described in Attachment A to this affidavit, stored at premises owned, maintained, 
controlled, or operated by US CENTCOM, headquartered at MacDill Air Force Base, 
Tampa, Florida, to search for evidence of: (a) unauthorized removal and retention of 
classified documents and material, in violation of 18 U.S.C. § 1924; (b) unauthorized 


possession and, inter alia, attempted communication and willful communication of 


national defense information to someone not entitled to receive it, as well as the willful 
retention of national defense information, in violation of 18 U.S.C. § 793(e); and (c) 


conspiracy to commit the aforementioned crimes, in violation of 18 U.S.C. § 371. 
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CONCLUSION 
41. Based on my training and experience, and the facts as set forth in this affidavit, your 
affiant asserts there is probable cause to believe that stored in the US CENTCOM email 
account, is , there exists evidence of a crime relating to: a) 
unauthorized removal and retention of classified documents and material, in violation of 


18 U.S.C. § 1924; (b) unauthorized possession and, inter alia, attempted communication 


and willful communication of national defense information to someone not entitled to 
receive it, as well as the willful retention of national defense information, in violation of 
18 U.S.C. § 793(e); and (c) conspiracy to commit the aforementioned crimes, in violation 
of 18 U.S.C, § 371. 

42. Based on the foregoing, I request that the Court issue the requested search warrant. 
Because the warrant will be served on US CENTCOM, who will then compile the 
requested records at a time convenient to it, there exists reasonable cause to permit the 
execution of the requested warrant at any time in the day or night. 

43. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by Title 18, United States Code, Section 2711; and 
Title 18, United States Code, Sections 2703(a), (b)(1)(A), and (c)(1)(A). Specifically, the 
Court is “a district court of the United States that has jurisdiction over the offenses being 
investigated,” Title 18, United States Code, Sections 1924, 793(e), and 371. Pursuant to 
Title 18, United States Code, Section 2703(g), the presence of a law enforcement officer 


is not required for the service or execution of this warrant. 
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REQUEST FOR SEALING 


44, Since this investigation is continuing, disclosure of the search warrant, this affidavit, 
and/or this application and the attachments thereto will jeopardize the progress of the 
investigation. Accordingly, it is respectfully requested that the Court issue an order that 
the search warrant, this affidavit in support of the application for search warrant, the 
application for search warrant, and all attachments thereto be filed under:seal until further 
order of this Court. 


Respectfully submitted, 


ae Ch ee 
Raju S. Bhatia 
Special Agent 
Federal Bureau of Investigation 


Sworn to and subscribed before me . 
on this, the _@***~__ day of August, 2013. 


BERT J. CONRAD, JR. 
UNITED STATS DISTRICT COURY JUDGE 
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ATTACHMENT A 


Particular Account To Be Searched 


This warrant applies to records and other information (including the contents of 
communications) for the account associated with the email address 
that is stored at premises controlled by US Central Command, which accepts service of legal 


process at MacDill Air Force Base, Tampa, Florida. 
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ATTACHMENT B 
Particular Things To Be Seized 
L Information To Be Disclosed by CENTCOM (“the Provider”) 
To the extent that the information described in Attachment A is within the 
_ possession, custody, or control of the Provider, including any emails, records, files, logs, or 
information that has been deleted but is still available to the Provider, the Provider is required to 
disclose the following information to the government for the account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account, draft emails, the source and destination 
addresses associated with each email, the date and time at which each email was sent, and the 
size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, records of session 
times and durations, the date on which the account was created, the length of service, the IP 
address used to register the account, log-in IP addresses associated with session times and dates, 

account status, alternative email addresses provided during registration, methods of connecting, 
log files, and means and source of payment (including any credit or bank account number); 

Ci The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, and files; and 

e. All records pertaining to communications between the Provider and any person 


regarding the account, including contacts with support services and records of actions taken. 
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IL. Information To Be Seized by the Government 


1. Al! records or information described above in Section I that constitute fruits, 


evidence, and instrumentalities of violations of the statutes listed on the warrant, 


including, for the account identified on Attachment A: 


a. 
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All records or information related to any communications between 
PETRAEUS and a: 

All records or information related to any communications, from December 
2008 to the present, between PETRAEUS and any other person or entity 
concerning classified and/or national defense information; 

All records or information, from December 2008 to the present, related to any 
classified and/or national defense information; 

All records or ‘ienition from December 2008 to the present, related to the 
source(s) or potential source(s) of any classified and/or national defense 
information provided by PETRAEUS to i: 

All records or information, from December 2008 to the present, related to the 
state of mind of any individuals concerning the communication, disclosure, 
receipt, or retention of classified and/or national defense information; 

All records or information relating to knowledge of laws, rules, regulations, 
and/or procedures prohibiting the unauthorized disclosure or retention of 
classified and/or national defense information; 

All records or information related to any communications from June 2012 to 
the present between PETRAEUS and any other person concerning ongoing 


law enforcement investigations; 
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h. All records or information concerning any email accounts, telephone numbers, 
or other methods of communication used by PETRAEUS or SR ; 

i. Any information recording PETRAEUS’s o schedule or 
travel from December 2008 to the present; 

Jj. Evidence of user attribution showing who used or owned the Device at the 
time the items described in this warrant were created, edited, or deletéd, such. 
as logs, phonebooks, address books, contact lists, saved usernames and 
passwords, documents, and browsing history; and 

k. Records evidencing the use of the Internet, including records of Internet 
Protocol addresses used; 

2. Information relating to who created, used, or communicated with the account, 
including records about their identities and whereabouts. . 

3. As used above, the terms “records” and “information” include all of the foregoing 
items of evidence in whatever form and by whatever means they may have been 
created or stored, including any form of computer or electronic storage (such as flash 


memory or other media that can store data) and any photographic form. 
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UNITED STATES DISTRICT COURT FOR THE 
WESTERN DISTRICT OF NORTH CAROLINA 


CHARLOTTE DIVISION 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-247 
v. ORDER TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF AND APPLICATION 


EMAIL ACCOUNT AS DESCRIBED IN 
AFFIDAVIT AND ATTACHMENT, 


) 
) 
) 
CONTENT AND FORENSIC IMAGES OF 
) 
INCORPORATED HEREIN. ) 


UPON MOTION of the United States of America, by and through Jill Westmoreland 
Rose, United States Attorney for the Western District of North Carolina, it appearing that on 
August 8, 2013, the Court issued a search warrant in the above-captioned case and placed under 
seal the warrant, the application for the warrant, and the affidavit in support of the application for 
the warrant; it further appearing that the government, after reviewing the materials in connection 
with pending Freedom of Information Act litigation in the United States Court for the District of 
Columbia, now seeks to unseal said documents, subject to redactions of personal identifying 
information, pursuant ee Local Criminal Rule 49(B) of this Court (the search warrant materials, 

‘as redacted by the government are attached hereto), it is hereby 

ORDERED that the search warrant, application for search warrant, and affidavit in 
support of the application for the search siateaat as redacted by the government, are hereby 
UNSEALED. 

The Clerk is directed to certify copies of this Order to the United States Attorney's 
Office. 


This the day of December, 2016. 
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UNITED STATES MAGISTRATE JUDGE 
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FILED 


UNITED STATES DISTRICT COURT FOR THE CHARLOTTE, NC 
WESTERN DISTRICT OF NORTH CAROLINA DEC 9 
CHARLOTTE DIVISION ~ 0 2016 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-24%,, US District Court 
) estern District of NC 
v. ) | MOTION TO UNSEAL THE 
. ) SEARCH WARRANT, AFFIDAVIT 

IN THE MATTER OF THE SEARCH OF ) AND APPLICATION 

CONTENT AND FORENSIC IMAGES OF ) fe ee 

EMAIL ACCOUNT AS DESCRIBED IN ) 

AFFIDAVIT AND ATTACHMENT, ) 

INCORPORATED HEREIN. ) 


NOW COMES the United States of America, by and through Jill Westmoreland Rose, 
United States Attorney for the Western District of North Carolina, who respectfully shows unto 
the Court that on August 8, 2013, the court issued a search warrant in the above-captioned case 
and placed under seal the warrant, the application for the warrant and the affidavit in support of 
the application for the warrant; after sopienand the materials in connection with pending 
Freedom of Information Act litigation in the United States District Court for the District of 
Columbia, the United States now seeks to unseal said documents, subject to redactions of 
personal identifying information, pursuant to Local Criminal Rule 49(B) of this Court (the search 
warrant materials, as redacted by the government, are attached hereto). 

THEREFORE, the United States respectfully moves the Court for the search warrant, the 
application for the warrant, and the affidavit in support of the application for the warrant listed 
above be unsealed. 

Respectfully submitted, on this day of December 19, 2016. 


JILL WESTMORELAND ROSE 
UNITED STATES ATTORNEY 


/Is/IJJLL WESTMORELAND ROSE 


ASSISTANT UNITED STATES ATTORNEY 
NC Bar Number # 17656 
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Attorney for USA 
Carillon Bldg, Suite 1700 
227 West Trade Street 
Charlotte, NC 28202 
Phone: 704-344-6222 
Fax: 704-344-6629 


Email: jill.rose@usdoj.gov 
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UNITED STATES DISTRICT COURT FOR THE 
WESTERN DISTRICT OF NORTH CAROLINA 


CHARLOTTE DIVISION 
; UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-247 
) 
V. ) ORDER TO UNSEAL THE 
) SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF ) AND APPLICATION 
CONTENT AND FORENSIC IMAGES OF a 
EMAIL ACCOUNT AS DESCRIBED IN ) 
AFFIDAVIT AND ATTACHMENT, ) 
INCORPORATED HEREIN. ) 


UPON MOTION of the United States of America, by and through Jill Westmoreland 
Rose, United States Attorney for the Western District of North Carolina, it appearing that on 
August 8, 2013, the Court issued a search warrant in the above-captioned case and placed under 
seal the warrant, the application for the warrant, and the affidavit in support of the application for 
the warrant; it further appearing that the government, after reviewing the materials in connection 
with pending Freedom of Information Act litigation in the United States Court for the District of 
Columbia, now seeks to unseal said documents, subject to redactions of personal identifying 
information, pursuant . Local Criminal Rule 49(B) of this Court (the search warrant materials, 
as redacted by the government are attached hereto), it is hereby 

ORDERED that the search warrant, application for search warrant, and affidavit in 
support of the application for the search siatianil as redacted by the government, are hereby 
UNSEALED. 

The Clerk is directed to certify copies of this Order to the United States Attorney's 
Office. 


This the oo 0. day of December, 2016. 


O Ahn 
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UNITED STATES MAGISTRATE JUDGE 
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* é 
AO 106 (Rev, 04/10) Application for a Search Warrant 


FILED 
UNITED STATES DISTRICT COURT  GHartottE, NC 
for the 
Western District of North Carolina AUG -~ 8 2013 
In the Matter of the Search of ) US District Court 
(Briefly describe the property to be searched ) Western District of NC 
or identify the person by name and address) ) Case No. 
Content and forensic images of email account as ) 
described in Affidavit and Attachment, incorporated } 
: herein. 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See attachment A, which is incorporated fully herein. 


located in the Western District of North Carofina , there is now concealed (identify the 
person or describe the property to be seized): 


See attachment B which is incorporated fully herein. 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

& evidence of a crime; 

f contraband, fruits of crime, or other items illegally possessed; 
3) property designed for use, intended for use, or used in’ committing a crime; 
CG a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. 1924 Unauthorized removal and retention of classified documents and materials. 
18 U.S.C. 793(e) Unauthorized possession, communication and willful retention of national defense 
information 


The application is based on these facts: 


wf Continued on the attached sheet. 


©) Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


(ea) Teas S Batasher 
A 


pplicant's signature 


Raju S. Bhatia Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


ween hadnt Comae9f - 


Judge's signature 


City and state: Charlotte, North Carolina _ Robert J. Carirad, Jr., United States District Court Judge 


Printed name and title 
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AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT 


I, Raju S Bhatia, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

I make this affidavit in support of an application for a search warrant for information 
associated with a certain account stored at premises owned, maintained, controlled, or 
operated by United States Central Command (US CENTCOM) headquartered at MacDill 
Air Force Base, Tampa, Florida. The information to be searched is described in the 
following paragraphs and in Attachment A, all incorporated fully by reference herein. 

. Tama Special Agent with the Federal Bureau of Investigation (FBI) and have been 
employed as such for over 14 years. I have investigated matters involving complex 
financial fraud, public corruption, organized crime, counterterrorism, and 
counterespionage. I am currently assigned to the Charlotte, North Carolina FBI office. 
Through investigations, experience, and training, I have become familiar with methods 
and operations employed by individuals attempting to conceal their illegal behavior. I 
have also received training in the proper collection, retention, and dissemination of 
classified information. 
. The facts in this affidavit come from my personal observations, my training and 
experience, evidentiary review, and information obtained from other Agents, government 
officials, and witnesses. This affidavit is intended to show merely that there is sufficient 
probable cause for the requested warrant and does not set forth all of my knowledge 


about this matter. 
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STATUTORY AUTHORITY 
4. The FBI has been conducting an investigation of DAVID PETRAEUS and 
isc «4 for possible violations of: (a) unauthorized removal and retention of 

classified documents and material, in violation of Title 18, United States Code, Section 
1924; (b) unauthorized possession and, inter alia, attempted communication‘and willful 
communication of national defense information to someone not entitled to receive it, as 
well as the willful retention of national defense information, in ictatiba of Title 18, 
United States Code, Section 793(e); and (c) conspiracy to commit the aforementioned 
crimes, in violation of Title 18, United States Code, Section 371. 

5. For the reasons set forth below, there is probable cause to believe that the email account 


i= —— (described in detail in Attachment A) 


contains evidence, fruits, and/or instrumentalities of violations of federal law, including, 


inter alia, the improper communication and/or retention of classified information. 


6. Title 18, United States Code, Section 1924(a) states: 


Whoever, being an officer, employee, contractor, or consultant of the United 
States, and, by virtue of his office, employment, position, or contract, becomes 
possessed of documents or materials containing classified information of the 
United States, knowingly removes such documents or materials without authority 
and with the intent to retain such documents or materials at an unauthorized 
location shall be fined under this title or imprisoned for not more than one year, or 
both. 


18 U.S.C. § 1924(a). 
7. Title 18, United States Code, Section 793(e) states: 


Whoever having unauthorized possession of, access to, or control over any 
document, writing, code book, signal book, sketch, photograph, photographic 
negative, blueprint plan, map, model, instrument, appliance, or note relating to the 
national defense, or information relating to the national defense which 
information the possessor has reason to believe could be used to the injury of the 
United States or to the advantage of any foreign nation, willfully communicates, 
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delivers, transmits or causes to be communicated, delivered, or transmitted, or 
attempts to communicate, deliver, transmit or cause to be communicated, 
delivered, or transmitted the same to any person not entitled to receive it, or 
willfully retains the same and fails to deliver it to the officer or employee of the 
United States entitled to receive it . . . shall be fined under this title or imprisoned 
not more than ten years or both. 
18 U.S.C. § 793(e). 
Title 18, United States Code, Section 371, makes punishable, by up to five years.in 
prison, a conspiracy among two or more persons to commit any offense against the 
United States. 
Classified information is defined by Executive Order 13526 (E.O. 13526) and relevant 
preceding Executive Orders, as information in any form that: (1) is owned by, produced 
by or for, or under the control of the United States government; (2) falls within one or 
more of the categories set forth in the E.O. 13526; and (3) is classified by an original 
classification authority who determines that its unauthorized disclosure reasonably could 
be expected to result in damage to the national security. Where such unauthorized 
disclosure reasonably could be expected to cause “damage” to the national security, the 
information is classified as “Confidential.” Where such unauthorized disclosure 
reasonably could be expected to cause “serious damage” to the national security, the 
information is classified as “Secret.” Where such unauthorized disclosure reasonably 


could be expected to cause “exceptionally grave damage” to the national security, the 


information is classified as “Top Secret.” 


. Pursuant to E.O. 13526, a person may only gain access to classified information if a 


favorable determination of eligibility for access has been made by an agency head or an 
agency head’s designee, the person has signed an approved nondisclosure agreement, and 


the person has a need-to-know the information. 
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11. 


PROBABLE CAUSE 
PETRAEUS is a retired United States Army General. From on or about October 31, 
2008 to June 30, 2010, PETRAEUS served as Commander of the United States Central 
Command. From on or about June 23, 2010 to July 18, 2011, PETRAEUS served as 
Commander of the International Security Assistance Force. From on or about September 
6, 2011 to November 9, 2012, PETRAEUS served as Director of the Central Intelligence 
Agency (CIA). At all times relevant to this affidavit, PETRAEUS held a United States 
government security clearance allowing him access to classified United States 
government information, To obtain that clearance, PETRAEUS was required to and 
would have agreed to properly protect classified information by not disclosing such 
information to persons not entitled to receive it, by not unlawfully feniivind classified 
information from authorized storage facilities, and by not storing classified information in 


unauthorized locations. 


Li” is a researcher and author of a biography of PETRAEUS, published in 


January 2012. From on or about July 18, 2003 until on or about November 14, 2012, 
PY held a United States government security clearance allowing her access 
to classified United States government information. To obtain that clearance, 
=< was required to and would have agreed to properly protect classified 
information by not disclosing such information to persons not entitled to receive it, by not 
unlawfully removing classified information from authorized storage facilities, and by not 


storing classified information in unauthorized locations. 


. In June 2012, the FBI’s Tampa Division (FBI Tampa) opened a computer intrusion 


investigation related to alleged cyber stalking activity. This investigation was predicated 
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ona complaint received from Witness 1, which alleged the receipt of threatening and 
harassing emails. Witness 1 claimed friendships with several high-ranking public and 
military officials. 

14. Evidence gathered during the FBI Tampa investigation indicated that someone had access 
to the personal schedule of PETRAEUS, who was then the Director of the CIA. This 
access indicated a potential breach of security, On or about June 22, 2012, FBI 
Headquarters (FBIHQ) notified PETRAEUS’s security detail of the ongoing computer 
intrusion investigation and the potential security issue. On July 19, 2012, FBI Tampa 
was notified by Witness 1 that he/she no longer wished to press charges against the cyber 
stalker. On August 10, 2012, Witness 1 informed FBI Tampa that PETRAEUS 
personally requested that Witness | withdraw his/her complaint and “call off the G-men.” 
On August 13, 2012, Witness 1 advised FBI Tampa that PETRAEUS believed the 
alleged cyber stalker possessed information which could “embarrass” PETRAEUS and 
other public officials. Ultimately the FBI determined, based upon the investigation, that 

Es the individual who had sent the emails to Witness 1. 

15. On September 24, 2012 as part of the FBI Tampa investigation, 
consented to a search of two laptops and two external hard drives belonging to her. A 
review of the digital media contained on these devices revealed over 100 items which 
were identified by Charlotte Computer Analysis Response Team (CART) Forensic 
Examiners as potentially containing classified information, up to the Secret level. 

16. On October 26, 2012, PETRAEUS was interviewed at CIA Headquarters. PETRAEUS 
stated that he had had an extramarital affair with RM). He denied providing 


any classified documents to a. or having any arrangement to provide her 
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17. 


18. 


with classified information. PETRAEUS stated that may have obtained 
documents in the course of conducting research for a book she was writing. He explained 
that reporters in theater (Afghanistan), such as HE , vere sometimes granted 
“off-the-record” access to classified presentations, such as the COMISAF’s (Commander, 
International Security Assistance Force) daily briefings. 

On November 2, 2012, FBI Tampa interviewed EEE. in Charlotte, North 
Carolina regarding the potentially classified documents found on her computers, She 
claimed she came into possession of several of the documents when she was in 
Afghanistan researching her book about PETRAEUS; however, she was unable to 
provide specifics as to how she obtained them. [EE stated that during her 
time in Afghanistan she was given access to several briefings, including at least one 
briefing at the Secret level. =e advised that reporters were often given such 
access in order to provide them with situational awareness of the war, In order to receive 
the briefings, [fs 8 = 4] signed an “off-the-record” agreement, which meant she 
could not write about classified information she observed. She stated she would 
sometimes obtain a paper copy of the briefings to preserve the information as research for 
her book. io 24) advised that she never received classified information from 
PETRAEUS. 

During interviews conducted of Sa and PETRAEUS under the 
aforementioned FBI Tampa investigation, each advised they used covert methods to 
communicate with each other. These methods included the use of pre-paid cellular 
telephones and email accounts using non-attributable names. Several of these covert 


email accounts were identified during the FBI Tampa investigation; however, it is not 
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known if all the accounts were identified because both and PETRAEUS 
stated they could not recall all the account names which they created and used to 
communicate. During ME September 25, 2012 interview, she advised that 
she and PETRAEUS would sometimes share the same account, .and would save messages 
to the draft folder instead of sending them via email. 

19, On November 12, 2012, Agents from the Charlotte and Tampa Divisions of the FBI 
participated in a consensual search of EM residence in ae, North 
Carolina to recover any evidence related to cyber stalking, a violation of 18 U.S.C. 

§ 2261A, and the unauthorized removal and retention of classified documents, a violation 
of 18 U.S.C. § 1924. During the search, numerous items were seized to include digital 


media as well as four boxes and one folder of documents. On this same date, 


HR edriinistrative assistant voluntarily provided the FBI with digital media 


as well as one box of documents which she maintained in her home in relation to her 
employment with ae. A review of the seized materials has identified to date 
hundreds of potentially classified documents, including more than 300 marked Secret, on 
digital images maintained on various pieces of electronic media. 

20. Of the potentially classified documents reviewed to date, the majority relate to U.S. 
military operations conducted in Afghanistan. {MM traveled into and out of 
Afghanistan several times between September 2010 and July 2011 to conduct research 
for a biography on PETRAEUS. During this time, PETRAEUS was serving as the 
International Security Assistance Force (ISAF) Commander. 

21. paper documents, digital data, and audio files indicate PETRAEUS 


played an integral role in granting EEE. access to classified information for the 
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purpose of writing his biography. For example, in an email dated January 16, 2011, 
which PETRAEUS marked as CONFIDENTIAL and sent to multiple members of the 
military, he instructed a member of his staff to “PLS PRINT FOR (RE, ON AN 
OFF THE RECORD BASIS.” Travel dociartictns show that NT was in 
Afghanistan at this time. | 


A. Communications Regarding Potential Mishandling of Classified 
Information 


22. On July 13, 2011, Hand a US. Army Captain exchanged several emails. 
ee, using email account 2d the Captain at 
his military email account, seeking information about military operations. In an email to 
the Captain, in which PETRAEUS was carbon copied (cc’d) at email account 

| HR. wrote, “If it’s ok with you, may 
I trouble you to send the storyboards (via SIPR') directly to GEN Petraeus (copied here) 
and he will print them out for me? (He is gracious and willing to help out given my 
compressed timeline!)” PETRAEUS followed up to this email by writing to the Captain 
and “Happy to help, Ml, if my SIPR account would be convenient. It’s 
on the main address list. We decided = was serious and have sought to help...” The 
Captain replied to PETRAEUS’s email, “Sir, I will be happy to send these on SIPR to 
your account for i. ..” Based on my training, experience, and information reviewed 
to date in this investigation, the email chain related to a document or series of documents 


provided by PETRAEUS to saa which contained classified information. This 


* SIPR is an acronym for Secure Internet Protocol Router network, a U.S. government 
communications system allowing the processing, storage, and communication of classified 
information up to the SECRET level. 
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2 


we 


email correspondence between fF and the Captain reflects some agreement 
by PETRAEUS to provide ——— _——_ 3} access to classified information. 

. Between July 13, 2011 and July 15, 2011, SME and a U.S. Army Lieutenant 
Colonel exchanged numerous emails. | using email account 
es. emailed the Lieutenant Colonel at his military email 
account, seeking information about military operations conducted by the Lieutenant 
Colonel’s unit. In requesting this information, [fu noted that in the past both 
storyboards and troop narratives had been useful in conveying such facts. In an email 
from the Lieutenant Colonel to J on July 15, 2011, he advised he was 
working on the storyboards and asked her for “a good SIPR number.” Later on July 15, 
201 7... replied to the Lieutenant Colonel’s email and carbon copied (cc’d) 
PETRAEUS at email account [I a. | 
response included the following: “[I]f you have classified material, GEN Petraeus has 
been gracious enough to allow me to have you send the storyboards and material to his 
SIPR account; I’I pick them up as soon as you send the word! I’ve copied him on this 
email. If it’s unclass, you can use my AKO or this account.” This email correspondence 
on HE. 2.04 the Lieutenant Colonel reflects some agreement by 


PETRAEUS to provide [EEE access to classified information. 


24. Based on these facts, there is probable cause to believe that PETRAEUS’s email account, 


regarding PETRAEUS’s sharing of classified information as well as 


, contains substantive communications 


access to and retention of classified information. 
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BACKGROUND CONCERNING EMAIL 

25. In my training and experience, I have learned that US CENTCOM provides electronic 
mail (“email”) access to uniformed and civilian employees. These users are provided an 
email account for use in their official duties. Consequently, US CENTCOM computers 
are likely to contain stored electronic communications (including retrieved and 
unretrieved email for US CENTCOM users) and information concerning users and their 
use of US CENTCOM services. This information would include details regarding users 
of US CENTCOM service, such as the user’s full name, physical locations, telephone 
numbers and other identifiers, account access information, email transaction information, 
and alternative email addresses. In my training and experience, such information may 
constitute eldeiee of the crimes under investigation because the information can be used 
to identify the account’s user or users. 

26. In general, an email that is sent toa CENTCOM subscriber is stored in the subscriber’s 
“mail box” on CENTCOM servers until the subscriber deletes the email. If the 
subscriber does not delete the message, the message can remain on CENTCOM servers 
indefinitely. 

27. When the subscriber sends an email, it is initiated at the user’s computer, transferred via 
the Internet to CENTCOM servers, and then transmitted to its end destination. 
CENTCOM often saves a copy of the email sent. Unless the sender of the email 
specifically deletes the email from the CENTCOM server, the email can remain on the 
system indefinitely. 

28. A CENTCOM subscriber can also store files, including emails, files and other data, on 


servers maintained and/or owned by CENTCOM. 


10 
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29. Subscribers to CENTCOM might not store, on their home computers, copies of the 
emails stored in their CENTCOM account. This is particularly true when the subscriber | 
accesses their CENTCOM account through the web, or if they do not maintain particular 
emails or files in their residence or on their home computer. 

30. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This 
information can include the date on which the account was created, the length of service, 
records of log-in (i.e., session) times and durations, the types of service utilized, the 
status of the account (including whether the account is inactive or closed), the methods 
used to connect to the account (such as logging into the account via the provider's 
website), and other log files that reflect usage of the account. In addition, email providers 
often have records of the Internet Protocol address (“IP address”) used to register the 
account and the IP addresses associated with particular logins to the account. Because 
every device that connects to the Internet must use an JP areen IP address information 
can help to identify which computers or other devices were used to access the email 
account, — 

31, In my training and experience, in some cases email account users will communicate 
directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers 
typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well records of any actions taken 


by the provider or user as a result of the communications. Such information may 
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constitute evidence of the crimes under investigation because the information can be used 
to identify the acenutitis user or users. 
LOCATION TO BE SEARCHED 

32. I anticipate executing this warrant under the Electronic Communications Privacy Act, in 
particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A), by using the 
requested warrant to require US CENTCOM to disclose to the government copies of the 
records and other information (including the content of communications) particularly 
described in Attachment A. Upon receipt of the information described in Attachment A, 
the information described in Attachment B will be subject to seizure by law enforcement. 

33. Based upon the foregoing, your affiant submits that probable cause exists for the issuance 
of a search warrant for information associated with a certain account, as more fully 
deesbed in Attachment A to this affidavit, stored at premises owned, maintained, 
controlled, or operated by US CENTCOM, headquartered at MacDill Air Force Base, 
Tampa, Florida, to search for evidence of: (a) unauthorized removal and retention of 


classified documents and material, in violation of 18 U.S.C. § 1924; (b) unauthorized 


possession and, inter alia, attempted communication and willful communication of 
national defense information to someone not entitled to receive it, as well as the willful 
retention of national defense information, in violation of 18 U.S.C. § 793(e); and (c) 


conspiracy to commit the aforementioned crimes, in violation of 18 U.S.C. § 371. 


- 12 
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| 


CONCLUSION 


34. Based on my training and experience, and the facts as set forth in this affidavit, your 


affiant asserts there is probable cause to believe that stored in the email account, 


fF , there exists evidence of a crime relating to: 


35. 


36. 


(a) unauthorized removal and retention of classified documents and material, in violation 


of 18 U.S.C. § 1924; (b) unauthorized possession and, inter alia, attempted 


communication and willful communication of national defense information to someone 
not entitled to receive it, as well as the willful retention of national defense information, 
in violation of 18 U.S.C. § 793(e); and (c) conspiracy to commit the aforementioned 
crimes, in violation of 18 U.S.C. § 371. . 

Based on the foregoing, I request that the Court issue the requested search warrant. 
Because the warrant will be served on US CENTCOM, who will then compile the 
requested records at a time convenient to it, there exists reasonable cause to permit the 
execution of the requested warrant at any time in the day or night. 

This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by Title 18, United States Code, Section 2711; and 
Title 18, United States Code, Sections 2703(a), (b)(1)(A), and (c)(1)(A). Specifically, the 
Court is ‘‘a district court of the United States that has jurisdiction over the offenses being 
investigated,” Title 18, United States Code, Sections 1924, 793(e), and 371. Pursuant to 
Title 18, United States Code, Section 2703(g), the presence of a law enforcement officer 


is not required for the service or execution of this warrant. 
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REQUEST FOR SEALING 


37, Since this investigation is continuing, disclosure of the search warrant, this affidavit, 
and/or this application and the attachments thereto will jeopardize the progress of the 
investigation. Accordingly, it is respectfully requested that the Court issue an-order that 
the search warrant, this affidavit in support of the application for search warrant, the 
application for search warrant, and all attachments thereto be filed under seal until further 
order of this Court. 


Respectfully submitted, 


ea & Base 


Raju S Bhatia 
Special Agent 
Federal Bureau of Investigation 


Sworn to and subscribed before me 
on this, the @™> day of August, 2013. 
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ATTACHMENT A | 


Particular Account To Be Searched 


This warrant applies to records and other information (including the contents of 
communications) for the account associated with the email address 
_—————— that is stored at premises controlled by US Central 


Command, which accepts service of legal process at MacDill Air Force Base, Tampa, Florida. 
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ATTACHMENT B 
Particular Things To Be Seized 
L Information To Be Disclosed by CENTCOM (“the Provider”) 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider, including any emails, records, files, logs, or information that 
has been deleted but is still available to the Provider, the Provider is required to disclose the 
following information to the government for the account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account, draft emails, the source and destination 
addresses associated with each email, the date and time at which each email was sent, and the 
size and length of each email; . 

b. All records or other information regarding the identification of the account, to 
include full name, ical address, telephone numbers and other identifiers, records of session 
times and durations, the date on which the account was created, the length of service, the IP 
address used to register the account, log-in IP addresses associated with session times and dates, 
account status, alternative email addresses provided during registration, methods of connecting, 
and log files; 

c. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, and files; and 

d. All records pertaining to communications between the Provider and any person 


regarding the account, including contacts with support services and records of actions taken. 
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IL. Information To Be Seized by the Government 
1. All records or information described above in Section I that constitute fruits, 
evidence, and instrumentalities of violations of the statutes listed on the warrant, 
including, for the account identified on Attachment A: 
a. All records or information related to any communications between 


PETRAEUS and 


b. All records or information related to any communications, from December 


2008 to the present, between PETRAEUS and any other person or entity 
concerning classified and/or national defense information; 

c. All records or information, from December 2008 to the present, related to any 
classified and/or national defense information; 

d. All records or information, from December 2008 to the present, related to the 
source(s) or potential source(s) of any classified and/or national defense 
information provided by PETRAEUS to SE: 

e. All records or information, from December 2008 to the present, related to the 


state of mind of any individuals concerning the communication, disclosure, 


receipt, or retention of classified and/or national defense information; 


f. Atl records or information relating to knowledge of laws, rules, regulations, 


and/or procedures prohibiting the unauthorized disclosure or retention of 
classified and/or national defense information; 

g. All records or information related to any communications from June 2012 to 
the present between PETRAEUS and any other person concerning ongoing 


law enforcement investigations; 
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h.. All records or information concerning any email accounts, telephone numbers, 
or other methods of communication used by PETRAEUS or | ti‘<@’ 
i. Any information recording PETRAEUS’s or ER scheaute or 
travel from December 2008 to the present; 
and 
j. Records evidencing the use of the Internet, including records of Internet 
Protocol addresses used; 
2. Information relating to who created, used, or communicated with the account, 
including records about their identities and whereabouts. 
3. Asused above, the terms “records” and “information” include all of the foregoing 
items of evidence in whatever form and by whatever means they may have been 
created or stored, including any form of computer or electronic storage (such as flash 


memory or other media that can store data) and any photographic form. 
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FILED 
CHARLOTTE, NC 


UNITED STATES DISTRICT COURT FOR THE DEC 20 2016 
WESTERN DISTRICT OF NORTH CAROLINA 
CHARLOTTE DIVISION US District Court 
Western District of NC 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-277 
v. MOTION TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT 

IN THE MATTER OF THE SEARCH OF AND APPLICATION 


SERIAL: WCAV5L400801T, AND 
CONTENTS, AS DESCRIBED IN 
AFFIDAVIT AND ATTACHMENTS 


) 
) 
) 
MYBOOK ESSENTIAL HARD DRIVE 
) 
) 
INCORPORATED HEREIN. ) 


NOW COMES the United States of America, by and through Jill Westmoreland Rose, 
United States Attorney for the Western District of North Carolina, who respectfully shows unto 
the Court that on September 23, 2013; the court issued a search warrant in the above-captioned 
case and placed under seal the warrant, the application for the warrant and the affidavit in 
support of the application for the warrant; after reviewing the materials in connection with 
pending Freedom of Information Act litigation in the United States District Court for the District 
of Columbia, the United States now seeks to unseal said documents, subject to redactions of 
personal identifying information, pursuant to Local Criminal Rule 49(B) of this Court (the search 
warrant materials, as redacted by the government, are attached hereto). 

THEREFORE, the United States respectfully moves the Court for the search warrant, the 
application for the warrant, and the affidavit in support of the application for the warrant listed 
above be unsealed. 

Respectfully submitted, on this day of December 19, 2016. 


JILL WESTMORELAND ROSE 
UNITED STATES ATTORNEY 


//s//JILL WESTMORELAND ROSE 
ASSISTANT UNITED STATES ATTORNEY 
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NC Bar Number # 17656 
Attorney for USA 
Carillon Bldg, Suite 1700 
227 West Trade Street 
Charlotte, NC 28202 
Phone: 704-344-6222 
Fax: 704-344-6629 


Email: jill.rose@usdoj.gov 
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UNITED STATES DISTRICT COURT FOR THE 
WESTERN DISTRICT OF NORTH CAROLINA 


CHARLOTTE DIVISION aie 
UNITED STATES OF AMERICA ) DOCKET NO,: 3:13-mj-277 
) 
v. ORDER TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF AND APPLICATION 


SERIAL: WCAV5L400801T, AND 
CONTENTS, AS DESCRIBED IN 
AFFIDAVIT AND ATTACHMENTS 


) 
) 
) 
MYBOOK ESSENTIAL HARD DRIVE 
) 
) 
INCORPORATED HEREIN. ) 


UPON MOTION of the United States of America, by and through Jill Westmoreland 
Rose, United States Attorney for the Western District of North Carolina, it appearing that on 
September 23, 2013, the Court issued a search warrant in the above-captioned case and placed 
under seal the warrant, the application for the warrant, and the affidavit in support of the 
application for the warrant; it further speeding that the government, after reviewing the 
materials in connection with pending Freedom of Information Act litigation in the United States 
Court for the District of Columbia, now seeks to unseal said documents, subj ect to redactions of 
personal identifying information, pursuant to Local Criminal Rule 49(B) of this Court (the search 
warrant materials, as redacted by the government are attached hereto), it is hereby 

ORDERED that the search warrant, application for search warrant, and affidavit in 

_ support of the application for the search warrant, as redacted by the government, are hereby 

UNSEALED. 

The Clerk is directed to certify copies of this Order to the United States Attorney's 
Office. 


This the es Oday of December, 2016. 
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UNITED STATES MAGISTRAPEMDer 
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09) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
Western District of North Carolina 


In the Matter of the Search of 


(Briefly describe the property to be searched , . 

or identify the person by name and address) Case No. 4 13 a 2 7 oa 

MyBook Essential hard drive serial: WCAV5L400801T, 

and contents, as described in Affidavit and Attachments 
incorporated herein. 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Western District of North Carolina 


(identify the person or describe the property to be searched and give its location): 
See Attachment A which is incorporated fully herein 


The person or property to be searched, described above, is believed to conceal (identify the person or describe the 


property to be seized): 
See Attachment B which is incorporated fully herein, 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 
property. 


YOU ARE COMMANDED to execute this warrant on or before October 4, 2013 
(not to exceed 14 days) 
0 in the daytime 6:00 a.m. to 10 p.m. & at any time in the day or night as I find reasonable cause has been 
established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge 
Robert J. Conrad, Jr. 


(name) 


CO I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be 
searched or seized (check the appropriate box) © for days (not to exceed 30). 


© until, the facts justifying, the later specific date of 


Date and time issued: 


Judge's signature 


City and state: Charlotte, North Carolina Robert J. Conrad, U.S. District Court Judge 


Printed name and title 
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0 9S REV 12709) Search ant Seizure Warram (Page 2} 


‘ 


Date and time warrant executed: Copy of warrant and inventory left with: 
Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original 
warrant to the designated judge. 


Executing officer's signature 


Printed name and title 
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* 
‘ AO 106 (Rev. 04/}0) Application for a Search Warrant 


UNITED STATES DISTRICT COURT 


for the 
Wester District of North Carolina 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 
MyBook Essential hard drive, serial WCAVSL400801T as 
described in Affidavit and Attachments, incorporated fully 
herein. 


Case No. 3:13) 277 


weer 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that [ have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See attachment A, which is incorporated fully herein. 


located in the Western ~ District of North Carolina , there is now concealed (identify the 
person or describe the property to be seized): 


See attachment B which is incorporated fully herein. 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
@ evidence of a crime; 
& contraband, fruits of crime, or other items illegally possessed; 
6 property designed for use, intended for use, or used in committing a crime; 


D a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. 1924 Unauthorized removal and retention of classified documents and materials. 
18 U.S.C. 793(e) Unauthorized possession, communication and willful retention of national defense 
information 


’ The application is based on these facts: 


See attached Affidavit which is incorporated fully herein 


Continued on the attached sheet. 


Cortifiad to te a Anotice of days (give exact ending date if more than 30 days: ) is requested 
current cary of oY ai USC. § 3103a, the basis of which is sat forth on the attached sheet. 
= Uisuict Cour . 


plants stGnature 


Diane Wehner, Special Agent, FBI 


Printed name and title 


Date Le Leaked mee fe signed in my presence. 


Date: 09/20/2013 


eee, 's signature 
City and state: Charlotte, North Carolina Robert J. ConyAd, Jr., United States District Court Judge 


Printed name and title 
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AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT. 


I, Diane M. Wehner, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for electronic 
information associated with certain hard drives supplied by the National Defense 
University (NDU)!. The information to be searched is described in the following 
paragraphs and in Attachment A, all incorporated fully by reference herein. 

2. Tama Special Agent with the Federal Bureau of Investigation (FBI) and have been 
employed as such for over 7 years. I have investigated matters involving complex 
financial fraud, public corruption and counterterrorism. I am currently assigned to the 
Charlotte, North Carolina FBI office. Through investigations, experience, and training, I 
have become familiar with methods and operations employed by individuals attempting 
to conceal their illegal behavior. I or also received specialized training in the proper 
collection, retention, and dissemination of classified information. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, evidentiary review, and information obtained from other Agents, government 
officials, and witnesses. This affidavit is intended to show merely that there is sufficient 
probable cause for the requested warrant and does not set forth all of my knowledge 


about this matter, 


*NDU is an acronym for National Defense University. NDU is an institution of higher education 
funded by the United Stated Department of Defense, intended to facilitate high-level training, 
education, and the development of national security strategy. It is located on the grounds of Fort 
Lesley McNair in Washington, D.C. 
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STATUTORY AUTHORITY 


4. The FBI has been conducting an investigation of DAVID PETRAEUS and | 
1 
fF for possible violations of: (a) unauthorized removal and retention of | 
classified documents and material, in violation of Title 18; United States Code, Section | 


1924; (b) unauthorized possession and, inter alia, attempted communication and willful 


communication of national defense information to someone not entitled to receive it, as 
well as the willful retention of national defense information, in violation of Title 18, 
United States Code, Section 793(e); and (c) conspiracy to commit the aforementioned 
crimes, in violation of Title 18, United States Code, Section 371. 

5. For the reasons set forth below, there is probable cause to believe that the electronic 
records held on the following hard drives: a My Book Essential hard drive, serial: 
“WCAV5L25257IT, a My Book Essential hard drive, serial: WCAZA5221633 and a My 
Book Essential hard drive, serial: WCAV5L400801T (all described in detail in 
Attachment A) contain evidence, fruits, and/or instrumentalities of violations of federal 
law, including, inter alia, the unlawful communication and/or retention of classified 


information. 


6, Title 18, United States Code, Section 1924(a) states: 


Whoever, being an officer, employee, contractor, or consultant of the United 
States, and, by virtue of his office, employment, position, or contract, becomes 
possessed of documents or materials containing classified information of the 
United States, knowingly removes such documents or materials without authority 
and with the intent to retain such documents or materials at an unauthorized 
location shall be fined under this title or imprisoned for not more than one year, or 
both. 


18 U.S.C. § 1924(a). 
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7. Title 18, United States Code, Section 793(e) states: ; | 


Whoever having unauthorized possession of, access to, or control over any | | 
document, writing, code book, signal book, sketch, photograph, photographic 
negative, blueprint plan, map, model, instrument, appliance, or note relating to the i 
national defense, or information relating to the national defense which , 
information the possessor has reason to believe could be used to the injury of the 
United States or to the advantage of any foreign nation, willfully communicates, 
delivers, transmits or causes to be communicated, delivered, or transmitted, or | 
attempts to communicate, deliver, transmit or cause to be communicated, | 
delivered, or transmitted the same to any person not entitled to receive it, or 
willfully retains the same and fails to deliver it to the officer or employee of the 1 
United States entitled to receive it . . . shall be fined under this title or imprisoned 
not more than ten years or both. 


18 U.S.C. § 793(e). 


8. Title 18, United States Code, Section 371, makes punishable, by up to five years in 


prison, a conspiracy among two or more persons to commit any offense against the 
United States. 
9. Classified information is defined by Executive Order 13526 (E.0. 13526) and relevant 
preceding Executive Orders, as information in any form that: (1) is owned by, produced 
by or for, or under the control of the United States government; (2) falls within one or 
more of the categories set forth in the E.O. 13526; and (3) is classified by an original 
classification authority who determines that its unauthorized disclosure reasonably could 


be expected to result in damage to the national security. Where such unauthorized 


disclosure reasonably could be expected to cause “damage” to the national security, the 
information is classified as “Confidential.” Where such unauthorized disclosure 
reasonably could be expected to cause “serious damage” to the national security, the 
information is classified as “Secret.” Where such unauthorized disclosure reasonably 
could be expected to cause “exceptionally grave damage” to the national security, the 


information is classified as “Top Secret.” 
3 
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10. Pursuant to E.O. 13526; a person may only gain access to classified information if a 


favorable determination of eligibility for access has been made by an agency head or an 


agency head’s designee, the person has signed an approved nondisclosure agreement, and 
the person has a need-to-know the information. 
PROBABLE CAUSE 


1 


— 


. PETRAEUS is a retired United States Army General. From on or about October 31, 
2008 to June 30, 2010, PETRAEUS served as Commander of the United States Central 
Command. From on or about July 4, 2010 to July 18, 201 1, PETRAEUS served as 
Commander of the International Security Assistance Force. From on or about September 
6, 2011 to November 9, 2012, PETRAEUS served as Director of the Central Intelligence | 
Agency (CIA). At all times relevant to this affidavit, PETRAEUS held a United States | 
government security clearance allowing him access to classified United States | 
government ‘iiciunabion, According to a Department of Defense (DOD) official, to | 
obtain that clearance, PETRAEUS was Tequired to and would have agreed to properly 
protect classified information by not disclosing such information to persons not entitled 


to receive it, by not unlawfully removing classified information from authorized storage 


facilities, and by not storing classified information in unauthorized locations. 


12. SB is a researcher and author of a biography of PETRAEUS, published in 
January 2012. Frorn on or about July 18, 2003 until on or about November 14, 2012, 
FY held a United States government security clearance allowing her access . | 

| 


to classified United States government information. According to a DOD official, to 


obtain that clearance, a’: required to and would have agreed to properly 


protect classified information by not disclosing such information to persons not entitled 
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to receive it, by not unlawfully removing classified information from authorized storage 
facilities, and by not storing classified information in unauthorized locations. 

13. In 2012, was the subject of an FBI Tampa Division (FBI Tampa) 
computer intrusion investigation concerning alleged cyber stalking activity. This 
investigation was predicated on a complaint received from Witness 1. This complaint 
alleged the receipt of threatening and harassing emails from an unknown individual. 
Witness 1 claimed to have friendships with several high-ranking public and military 
officials. 

14. Evidence gathered during the FBI Tampa investigation indicated that someone had access 
to the personal schedule of PETRAEUS, who was then the Director of the CIA. This 
access indicated a potential breach of security. On or about June 22, 2012, FBI 
Headquarters (FBIHQ) notified PETRAEUS’s security detail of the ongoing computer 

. intrusion investigation and the potential security issue. On July 19, 2012, FBI Tampa 
was notified by Witness 1 that he/she no longer wished to press charges against the cyber 
stalker. On ‘agi 10, 2012, Witness 1 informed FB] Tampa that PETRAEUS 
personally requested that Witness 1 withdraw his/her complaint and “call off the G-men.” 
On August 13, 2012, Witness | advised FBI Tampa that PETRAEUS believed the 
alleged cyber stalker possessed information which could “embarrass” PETRAEUS and 
other public officials. Ultimately the FBI determined, based upon the investigation, that 

ke ere al] was the individual who had sent the emails to Witness 1, 

15. On September 24, 2012 as part ofthe FBI Tampa investigation, 

consented to a search of two laptops and two external hard drives belonging to her. A 


review of the digital media contained on these devices revealed over 100 items which 
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were identified by Charlotte Computer Analysis Response Team (CART) Forensic 


Examiners as potentially containing classified information, up to the Secret level. 


16. On October 26, 2012, PETRAEUS was interviewed at CIA Headquarters. PETRAEUS 


stated that he had had an extramarital affair with A. He denied providing 
any classified documents i or having any arrangement to provide her 
with classified information. PETRAEUS stated that [, may have obtained 


‘ documents in the course of conducting research for a book she was writing. He explained 


that reporters in theater (Afghanistan), such as i. were sometimes granted 
“off-the-record” access to classified presentations, such as the COMISAF’s (Commander, 


International Security Assistance Force) daily briefings. 


_ On November 2, 2012, FBI Tampa interviewed [EEE in Charlotte, North 


Carolina regarding the potentially classified documents found on her computers. She 
claimed she came into possession of several of the documents when she was in 
Afghanistan researching her book about PETRAEUS; however, she was unable to 
provide specifics as to how she obtained them. [NN stated that during her 
time in Afghanistan she was given access to several briefings, including at least one 
briefing at the Secret level. [== =| advised that reporters were often given such 
access in order to provide them with situational awareness of the war. In order to receive 
the briefings, ee: gned an “off-the-record” agreement, which meant she 
could not write about classified information she observed. She stated she would 
sometimes obtain a paper copy of the briefings to preserve the information as research for 
her book. NN. advised that she never received classified information from 


PETRAEUS. 
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18. During interviews conducted of MME, and PETRAEUS under the 
aforementioned FBI Tampa investigation, each advised they used covert methods to | 


communicate with each other. These methods included the use of email accounts using 


non-attributable names and pre-paid cellular telephones. Several of these covert email 
accounts were identified during the FBI Tampa investigation; however, it is not known if 
all the accounts were identified because both IMEEM. and PETRAEUS stated 
they could not recall all the account names which they created and used to | 
communicate. Duin September 25, 2012 interview, she advised that | 
she and PETRAEUS would sometimes share the same account, and would save messages | 
to the draft folder instead of sending them via email. 

19. On November 12, 2012, Agents from the Charlotte and Tampa Divisions of the FB] 
participated in a consensual search of fF residence in [=] North 
Carolina to recover any evidence related to cyber stalking, a violation of 18 U.S.C. 


§ 2261A, and the unauthorized removal and retention of classified documents, a violation 


of 18 U.S.C. § 1924. During the search, numerous items were seized to include digital 
media as well as four boxes and one folder of documents. On this same date, 


————— = | administrative assistant voluntarily provided the FBI with digital media 


as well as one box of documents which she maintained in her home in relation to her 
employment with i. A review of the seized materials has identified to date 
hundreds of potentially classified documents, including more than 300 marked Secret, on 
digital images maintained on various pieces of electronic media. 

20. Of the potentially classified documents reviewed to date, the majority relate to US. 


military operations conducted in Afghanistan. BE «221-3 into and out of 
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Afghanistan several times between September 2010 and July 2011 to conduct research 
for a biography on PETRAEUS. During this time, PETRAEUS was serving as the 
International Security Assistance Force (ISAF) Commander. 

21. HE paper documents, digital data, and audio files indicate PETRAEUS 
played an integral role in granting [NN access to classified information for the 


purpose of writing his biography. 


A. Communications Regarding Potential Mishandling of Classified 
Information 


22, On May 12, 2011, a. using email account [a 


sent an email to PETRAEUS at email account 

SSSsz The subject line of the email read: “what part of 
4...” and the body of the email read: “is secret? The stuff in parenthesis, or the second 
sentence?” Based on my training, experience, and information reviewed to date in this 
investigation, your affiant believes the email related to a document or series of documents 
provided by PETRAEUS to ME. which contained classified information. 

23. Between July 13, 2011 and July 15, 2011, KM and a U.S. Army Lieutenant 

Colonel exchanged numerous emails. i, using email account 

ia ae emailed the Lieutenant Colonel at his military: email 
account, seeking information about military operations conducted by the Lieutenant 
Colonel’s unit. In requesting this information, ne noted that in the past both 
storyboards and troop narratives had been useful in conveying such facts. In an email 


from the Lieutenant Colonel to a « July 15, 2011, he advised he was 
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»? Tater on July 15, 


working on the storyboards and asked her for “a good SIPR number. 
2011, Pee replied to the Lieutenant Colonel’s email and carbon copied (cc’d) 
PETRAEUS at email account Sq = —— 1 
response included the following: “[I]f you have classified material, GEN Petraeus has 
been gracious enough to allow me to have you send the storyboards and material to his 
SIPR account; I'l] pick them up as soon as you send the word! I’ve copied him on this 
email. If it’s unclass, you can use my AKO or this account.” This email correspondence 
between isi and the Lieutenant Colonel likely reflects some agreement by 
PETRAEUS to provide Sz access to classified information. 


24. From June 12, 2011 through June 15, 2011, (MME. using email address 


HE. 26 PETRAEUS, using email address 
—— , discussed several topics, to include files 


maintained by PETRAEUS. In the email string, which contained the subject line 
“Chapter 2, ER ise issues which PETRAEUS addressed by typing in all 
capital letters within the body of’ ee. original emails. In the email string, 
while discussing PETRAEUS’ files, EEE wrote, “[T]he Galvin letters are 
naturally very helpful in this regard (I want more of them!!! I know Seiten holding 
back...)” In response to this point in iy. email, PETRAEUS wrote: 
“THEY’RE IN BOXES AND ’LL GET THEM OUT WHEN WE UNPACK AT THE 


HOUSE IN LATE JULY/AUG.” 


* SIPR is an acronym for Secure Internet Protocol Router network, a U.S. government 
communications system allowing the processing, storage, and communication of classified 
information up to the SECRET level. 
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25 NE responded: “Thanks for your willingness to get out the boxes! 
ial the librarian at NDU, has the full collection as well, if it’s easier to just gain 
access to them there.” In response PETRAEUS wrote: “SHE DOESN’T HAVE THE 
FILES ’ VE GOT AT HOME: NEVER GAVE THEM TO HER.” 


26. In an email string initiated on or about June 19, 2011, PETRAEUS, using email address 


7. {| _ and SR , using email address 
a *2nged over ten emails. In the first email, with the 


subject line “Found the”, PETRAEUS discussed locating his “Galvin files” as well as 
other files and expressed his willingness to share them with ==_—_—_————E. 
PETRAEUS wrote: “[G]iven various reassurances from a certain researcher, I will not 
triage them!” Your Affiant believes the term “triage” refers to the classified contents of 
the documents. BE: 2<ss¢ her excitement about PETRAEUS’s 
willingness to share the files writing: “[I]’Il protect them. And I’ll protect you.” 
PETRAEUS later responded to | sO writing, “[M]y files at home only go up 
to about when IJ took cmd of the 101", though there may be some MNSTC-I and other 
ones. Somewhere in 2003, I stopped nice filing and just started chunking stuff in boxes 
that gradually have gone, or will go, to NDU. Can search them at some point if they’re 
upstairs, but they’re not organized enough at this point...” PETRAEUS continued, 
writing, “[A]nd I think MNSTC-I files went to NDU, though I’m not sure. The key to 
find there would be the weekly reports that the CIG did with me. Not sure if JJ kept 


copies. Class’d, but I guess I might share!” (emphasis added). 


> MNSTC-I is an acronym for Multi-National Security Transition Command-Iraq. MNSTC-I 
was a branch of the Multi-National Force-Iraq (MNF-I). Petraeus was the former commander of 
MNF-I. 
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eee enn eeee——e——eeEEEEEE————EEEEE——————ee 


27. Your affiant believes that PETRAEUS’s reference to “Class’d” means the documents he 
is discussing --- and which he indicates he is willing to provide i, --~ are 
classified. 


2 


oC 


. Your affiant believes PETRAEUS and SS communicated about the sharing 
of classified information via PETRAEUS’s NIPR* email account. Additionally, based on 
paragraph 23 above, your affiant believes PETRAEUS allowed classified documents for 
a. be sent to his SIPR email account. 

BACKGROUND CONCERNING NDU COLLECTION 

29. Through my training and experience, I have learned that in accordance with the 

provisions of Title 44, United States Code, Section 3301, 1, PETRAEUS transferred and 

delivered to NDU, for inclusion in the collections of NDU’s library, a collection of 
personal papers and other non-record personal property. 


3 


S 


In general, the collection is made up of PETRAEUS’s personal files. The collection 
includes both classified and unclassified documents. The classified collection contains 
items such as reports, briefings, background material and glossaries, The unclassified 
collection includes items such as speeches, talking points to the press, newspaper articles 
and photographs. 


3 


=. 


. PETRAEUS’s physical documents were provided to NDU in September 2011. 
PETRAEUS’s electronic documents were provided to NDU in May or June 2012 via 
hard drives. 

32, PETRAEUS’s historian provided NDU with three hard drives related to PETRAEUS; 

two classified and one unclassified. The historian provided two classified hard drives as 


“NIPR is an acronym for Non-Classified Internet Protocol Router network, a U.S. government 
communication system allowing for the exchange of sensitive but unclassified information. 
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33. 


34. 


35. 


36. 


one hard drive contained NATO classified information and the other hard drive contained 
United States classified information. Later, PETRAEUS’s historian wanted to add 
additional information to the single unclassified hard drive, therefore, PETRAEUS’s 
historian asked NDU to return it. PETRAEUS’s historian then combined all the 
unclassified information onto a single hard drive that was provided to NDU. Both the 
unclassified hard drive and classified hard drives contain information related to 
PETRAEUS’s career, including his time as Commander of the International Security 
Assistance Force. 

The unclassified hard drive contained photographs, speeches made by PETRAEUS, 
newspaper articles, talking points to the press, administrative paperwork, including 
tracking calendars and orders, as well as PETRAEUS’s NIPR email. 

The classified hard drives primarily contain PETRAEUS’s SIPR email, as well as 
briefings, classified talking points, reference material, background briefs, maps and daily 
updates. 

On or about August 6, 2013, NDU consented to a search of two hard drives from 
PETRAEUS’s collection. A My Book Essential hard drive, serial: WCAV5L25257IT 
and a My Book Essential hard drive, serial: WCAZA5221633 were transferred from a 
NDU representative to FBI Agents from the Washington Field Office. The hard drives 
were then shipped to FBI Charlotte and are currently in the possession of FBI Charlotte. 
The hard drives are maintained by FBI employees not assigned to the instant matter. 

On or about August 22, 2013, NDU consented to a search of a My Book Essential hard 
drive, serial: WCAVSL400801T. This hard drive had been inadvertently overlooked 


when NDU provided consent on the other two hard drives on or about August 6, 2013. 
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37. Because it is probable that these drives contain email communications through 
Petraeus’s retirement from the inilitery: theré is probable cause to believe they contain 
communications between Petraeus and EM, including an email sent to Petraeus’s 
SIPR account attaching a classified document intended for delivery to JME. 

LOCATION TO BE SEARCHED 

38. I anticipate executing this warrant under the Electronic Communications Privacy Act, in 
particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A), by using the 
requested warrant to require FBI Charlotte to disclose to the government the contents of 
the hard drives described herein (including the content of communications) particularly 
described in Attachment A. Upon receipt of the information described in Attachment A, 
the information described in Attachment B will be subject to seizure by law enforcement. 

39. Based upon the foregoing, your affiant submits that probable cause exists for the issuance 
of a search warrant for information found on certain hard drives, as more fully described 
in Attachment A to this affidavit, stored at premises owned, maintained, controlled, or 
operated by FBI Charlotte, to search for evidence of. (a) unauthorized removal and 
retention of classified documents and material, in violation of 18 U.S.C. § 1924; (b) 


unauthorized possession and, inter alia, attempted communication and willful 


communication of national defense information to someone not entitled to receive it, as 
well as the willful retention of national defense information, in violation of 18 U.S.C. 
§ 793(e); and (c) conspiracy to commit the aforementioned crimes, in violation of 18 


U.S.C. § 371. 
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CONCLUSION 


40. Based upon the foregoing, your affiant submits that there is sufficient probable cause to 


4 


— 


42. 


believe that stored on the hard drives, there exists evidence of a crime relating to: a) 


unauthorized removal and retention of classified documents and material, in violation of 


18 U.S.C. § 1924; (b) unauthorized possession and, inter alia, attempted communication 


and willful communication of national defense information to someone not entitled to 
receive it, as well as the willful retention of national defense information, in violation of 
18 U.S.C. § 793(e); and (c) conspiracy to commit the aforementioned crimes, in violation 


of 18 U.S.C. § 371. 


. Based on the foregoing, I request that the Court issue the requested search warrant. 


Because the warrant will be served on FBI Charlotte, who will then compile the 
requested records at a time convenient to it, there exists reasonable cause to permit the 


execution of the requested warrant at any time in the day or night. 


REQUEST FOR SEALING 
Since this investigation is continuing, disclosure of the search warrant, this affidavit, 
and/or this application and the attachments thereto will jeopardize the progress of the 
investigation. Accordingly, it is respectfully requested that the Court issue an order that 
the search warrant, this affidavit in support of the application for search warrant, the 
application for search warrant, and all attachments thereto be filed under seal until further 


order of this Court. 
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Sworn to and subscribed before me 
on this, the A, oT day of September, 2013. 
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Respectfully submitted, 


Special Agent 
Federal Bureau of Investigation 


ATTACHMENT A 


Particular Account To Be Searched 


This warrant applies to records and other information (including the contents of 
communications) contained on the My Book Essential hard drive, serial: WCAV5L25257IT, the 
My Book Essential hard drive, serial: WCAZA5221633 and the MyBook Essential hard drive, 
serial WCAV5L400801T that are stored at premises controlled by the FBI, which accepts service 


of legal process at FBI Charlotte, Charlotte, North Carolina. 
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ATTACHMENT B 


Particular Things To Be Seized 


1. All records, information, documents and items on the hard drives that constitute 
fruits, evidence, and instrumentalities of violations of the statutes listed on the . 
warrant: 

a. All records or information related to any communications between 
PETRAEUS and Eo - 

b. All records or information related to any communications, from December 
2008 to the present, between PETRAEUS and any other person or entity 
conceming classified and/or national defense information; 

c. All records or information, from December 2008 to the present, related to any 


classified and/or national defense information; 


a All records or information, from December 2008 to the present, related to the i 
source(s) or potential source(s) of any classified and/or national defense 
information provided by PETRAEUS to ft 

e. All records or information, from December 2008 to the present, related to the 
state of mind of any individuals concerning the communication, disclosure, 
receipt, or retention of classified and/or national defense information; 

f. All records or information relating to knowledge of laws, rules, regulations, 
and/or procedures prohibiting the unauthorized disclosure or retention of 


classified and/or national defense information; 
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T 
| 
g. All records or information concerning any email accounts, telephone numbers, | 
1 
or other methods of communication used by PETRAEUS; _ 


h. Any information recording PETRAEUS’s schedule or travel from December 


2008 to the present; 
2. As used above, the terms “records” and “«nformation” include all of the foregoing 
items of evidence in whatever form and by whatever means they may have been 
created or stored, including any form of computer or electronic storage (such as flash 


memory or other media that can store data) and any photographic form. 
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FILED 
CHARLOTTE, NC 


DEC 2.0 2016 | 
UNITED STATES DISTRICT COURT FOR THE -] 
WESTERN DISTRICT OF NORTH CAROLINA US District Court 
CHARLOTTE DIVISION Western District of NC 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-278 | 
v. MOTION TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT 


IN THE MATTER OF THE SEARCH OF 


MYBOOK ESSENTIAL HARD DRIVE 


) 

) 

AND APPLICATION 
SERIAL: WCAV5L25257IT, AND 

) 

) 


CONTENTS, AS DESCRIBED IN 
AFFIDAVIT AND ATTACHMENTS 
INCORPORATED HEREIN. 


NOW COMES the United States of America, by and through Jill Westmoreland Rose, 
United States Attorney for the Western District of North Carolina, who respectfully shows unto 
the Court that on September 23, 2013, the court issued a search warrant in the above-captioned 
case and placed under seal the warrant, the application for the warrant and the affidavit in 
support of the application for the warrant; after reviewing the materials in connection with 
pending Freedom of Information Act litigation in the United States District Court for the District 
of Columbia, the United States now seeks to unseal said documents, subject to redactions of. 
personal identifying information, pursuant to Local Criminal Rule 49(B) of this Court (thé search 
warrant materials, as redacted by the government, are attached hereto). 

THEREFORE, the United States respectfully moves the Court for the search warrant, the 
application for the warrant, and the affidavit in support of the application for the warrant listed 
above be unsealed. 

Respectfully submitted, on this day of December 19, 2016. 


JILL WESTMORELAND ROSE 
UNITED STATES ATTORNEY 


/s//MILL WESTMORELAND ROSE 
ASSISTANT UNITED STATES ATTORNEY 
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NC Bar Number # 17656 
Attorney for USA 
Carillon Bldg, Suite 1700 
227 West Trade Street 
Charlotte, NC 28202 
Phone: 704-344-6222 
Fax: 704-344-6629 


Email: jill rose@usdoj.gov 
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ena 


Fyre. : 
UNITED STATES DISTRICT COURT FOR THE FEU) 2016 
' WESTERN DISTRICT OF NORTH CAROLINA ti), 


CHARLOTTE DIVISION 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-278 
) 
v. ORDER TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF AND APPLICATION 


) 
) 
) 
MYBOOK ESSENTIAL HARD DRIVE ) 
SERIAL: WCAV5L25257IT, AND ) 
CONTENTS, AS DESCRIBED IN ) 
AFFIDAVIT AND ATTACHMENTS ) 
INCORPORATED HEREIN. ) 


UPON MOTION of the United States of America, by and through Jill Westmoreland 
Rose, United States Attorney for the Western District of North Carolina, it appearing that on 
September 23, 2013, the Court issued a search warrant in the above-captioned case and placed 
under seal the warrant, the application for the warrant, and the affidavit in support of the 
application for the warrant; it further appearing that the government, after reviewing the 
materials in connection with pending Freedom of Information Act litigation in the United States 
Court for the District of Columbia, now seeks to unseal said documents, subject to redactions of 
personal identifying information, pursuant to Local Criminal Rule 49(B) of this Court (the search 
warrant materials, as redacted by the government are attached hereto), it is hereby 

ORDERED that the search warrant, application for search warrant, and affidavit in 
support of the application for the search warrant, as redacted by the government, are hereby 
UNSEALED. 

The Clerk is directed to certify copies of this Order to the United States Attorney's 
Office. 


This the a Y day of December, 2016. 
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UNITED STATES MAGISTRATE 
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i 
i 
v. 12/09) Search and Seizure Warrant | 
i 
t 


UNITED STATES DISTRICT COURT 


for the 
Western District of North Carolina 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


Case No. 


MyBook Essential hard drive serial: WCAV5L252571T, 
and contents, as described in Affidavit and Attachments 
incorporated herein. 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Western District of North Carolina 


(identify the person or describe the property to be searched and give its location): 
See Attachment A which is incorporated fully herein 


The person or property to be searched, described above, is believed to conceal (identify the person or describe the i 
property to be seized). . : : 1 
See Attachment B which is incorporated fully herein. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 


property. 
You ARE COMMANDED to execute this warrant on or before October 4, 2013 
(not to exceed 14 days) 
O in the daytime 6:00 a.m, to 10 p.m. of at any time in the day or night as I find reasonable cause has been 


established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge 
Robert J. Conrad, Jr. 


(name) 


0 I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be 
searched or seized (check the appropriate box) () for days (not to exceed 30). 


CO until, the facts justifying, the later specific date of 


Date and time issued: 


Judge's signature 


City and state: Charlotte, North Carolina Robert J. Conrad, U.S. District Court Judge 


Printed name and title 
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; AQ. 93 (Rev. 12/09) Search and Seizure Warrant (Page 2) 


Return 


Date and time warrant executed: Copy of warrant and inventory left with: 
Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


I declare under penalty of perjury that this inventory is correct and was returned along with the original 
warrant to the designated judge. 


Executing officer's signature 


Printed name and title 
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AO 106 (Rey. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT 


for the 
Western District of North Carolina 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


Case No. 3/13) 278 


MyBook Essential hard drive, serial WCAV5L25257!T as 
described in Affidavit and Attachments, incorporated fully 
herein. 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See attachment A, which is incorporated fully herein. 


located in the Western District of North Carolina , there is now concealed (identify the 
person or describe the property to be seized): 


See attachment B which is incorporated fulty herein. 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
mw evidence of a crime; 
A contraband, fruits of crime, or other items illegally possessed; 
, © property designed for use, intended for use, or used in committing a crime; 
0 a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. 1924 Unauthorized removal and retention of classified documents and materials. 
18 U.S.C. 793(e) Unauthorized possession, communication and willful retention of national defense 
information 


The application is based on these facts: 


See attached Affidavit which is incorporated fully herein 


es Continued on the attached sheet. 


Jertifiad tocbametyerdmptice of days (give exact ending date if more than 30 days: ) is requested 
Garnet ee ay ofall S.C § 3103a, the basis of which is set forth on the attached sheet. 


ipplicaht 's “Signature 


Diane Wehner, Special Agent, FBI 
Printed name and title 


Des e.and signed in my presence. 
Date: 09/20/2013 
F Cena) ‘5 signature 
City and state: Charlotte, North Carolina Robert J. Conrad Jr., United States District Court Judge 


Printed name and title 
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AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT 


J, Diane M. Wehner, being first duly swom, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 
“1. Imake this affidavit in support of an application for a search warrant for electronic 
information associated with certain hard drives supplied by the National Defense 
University (NDU)'. The information to be searched is described in the following 
paragraphs and in Attachment A, all incorporated fully by reference herein. 

2. I am a Special Agent with the Federal Bureau of Investigation (FRI) and have been 
employed as such for over 7 years. I have investigated matters involving complex 
financial fraud, public corruption and counterterrorism. J am currently assigned to the 
Charlotte, North Carolina FBI office. Through investigations, experience, and training, I 
have become familiar with methods and operations employed by individuals attempting 
to conceal their illegal behavior. I have also received specialized training in the proper 

. collection, retention; and dissemination of classified information. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, evidentiary review, and information obtained from other Agents, government 
officials, and witnesses. This affidavit is intended to show merely that there is sufficient 
probable cause for the reausiied warrant and does not set forth all of my knowledge 


about this matter. 


*NDU is an acronym for National Defense University. NDU is an institution of higher education 
funded by the United Stated Department of Defense, intended to facilitate high-level training, 
education, and the development of national security strategy. It is located on the grounds of Fort 
Lesley McNair in Washington, D.C. 
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STATUTORY AUTHORITY 
4. The FBI has been conducting an investigation of DAVID PETRAEUS and [my 
tl for possible violations of: (a) unauthorized removal anil retention of 
classified documents and material, in violation of Title 18, United States Code, Section 


1924; (b) unauthorized possession and, inter alia, attempted communication and willful 


communication of national defense information to someone not entitled to receive it, as 
well as the willful retention of national) defense information, in violation of Title 18, 
United States Code, Section 793(e); and (c) conspiracy to commit the aforementioned 
crimes, in violation of Title 18, United States Code, Section 371. 

5. For the reasons set forth below, there is probable cause to believe that the electronic 

"records held on the following hard drives: a My Book Essential hard drive, serial: 

WCAVSL25257IT, a My Book Essential hard drive, serial: WCAZA5221633 and a My 
Book Essential hard drive, serial: WCAV5L400801T (all described in detail in 
Attachment A) contain evidence, fruits, and/or instrumentalities of violations of federal 


law, including, inter alia, the unlawful communication and/or retention of classified 


information. 
6. Title 18, United States Code, Section 1924(a) states: 


Whoever, being an officer, employee, contractor, or consultant of the United 
States, and, by virtue of his office, employment, position, or contract, becomes 
possessed of documents or materials containing classified information of the 
United States, knowingly removes such documents or materials without authority 
and with the intent to retain such documents or materials at an unauthorized 
location shall be fined under this title or imprisoned for not more than one year, or 
both. 


18 U.S.C. § 1924(a). 
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7. Title 18, United States Code, Section 793(e) states: 


Whoever having unauthorized possession of, access to, or control over any 
document, writing, code book, signal book, sketch, photograph, photographic 
negative, blueprint plan, map, model, instrument, appliance, or note relating to the 
national defense, or information relating to the national defense which 
information the possessor has reason to believe could be used to the injury of the 
United States or to the advantage of any foreign nation, willfully communicates, 
delivers, transmits or causes to be communicated, delivered, or transmitted, or 1 
attempts to communicate, deliver, transmit or cause to be communicated, : 
delivered, or transmitted the same to any person not entitled to receive it, or 
willfully retains the same and fails to deliver it to the officer or employee of the 
United States entitled to receive it . . . shall be fined under this title or imprisoned 
not more than ten years or both. 


18 U.S.C. § 793(e). 

8. Title 18, United States Code, Section 371, makes punishable, by up to five years in 
prison, a conspiracy among two or more persons to commit any offense against the 
United States. | 

9. Classified information is defined by Executive Order 13526 (E.O. 13526) and relevant | 
preceding Executive Orders, as information in any form that: (1) is owned by, produced 
by or for, or under the control of the United States government; (2) falls within one or . 


more of the categories set forth in the E.O. 13526; and (3) is classified by an original 


classification authority who determines that its unauthorized disclosure reasonably could 


be expected to result in damage to the national security. Where such unauthorized 
disclosure reasonably could be expected to cause “damage” to the national security, the 
information is classified as “Confidential.” Where such unauthorized disclosure 
reasonably could be expected to cause “serious damage” to the national security, the 
information is classified as “Secret.” Where such unauthorized disclosure reasonably 
could be expected to cause “exceptionally grave damage” to the national security, the 


information is classified as “Top Secret.” 


3 
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10. Pursuant to E.O. 13526, a person may only gain access to classified information if a 
favorable determination of eligibility for access has been made by an agency head or an 
agency head’s designee, the person has signed an approved nondisclosure agreement, and 
the person has a need-to-know the information. 

PROBABLE CAUSE 

11. PETRAEUS is a retired United States Army General. From on or about October 31, 
2008 to June 30, 2010, PETRAEUS served as Commander of the United States Central 
Command. From on or about July 4, 2010 to July 18, 2011, PETRAEUS served as 
Commander of the International Security Assistance Fibs From on or about September 
6, 2011 to November 9, 2012, PETRAEUS served as Director of the Central Intelligence 
Agency (CIA). At all times relevant to this affidavit, PETRAEUS held a United States 
government security clearance allowing him access to classified United States 
government information. According to a Department of Defense (DOD) official, to 
obtain that clearance, PETRAEUS was required to and would have agreed to properly 
protect classified information by not disclosing such information to persons not entitled 
to receive it, by not unlawfully ening classified information from authorized storage 
facilities, and by not storing classified information in unauthorized locations. 

2 ii is a researcher and author of a biography of PETRAEUS, published in 
January 2012. From on or about July 18, 2003 until on or about November 14, 2012, 
HE eld a United States government security clearance allowing her access 
to classified United States government information. According to a DOD official, to 


obtain that clearance [ii was required to and would have agreed to properly 


protect classified information by not disclosing such information to persons not entitled 
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13. 


14. 


_ 
imal 


Case 


to receive it, by not unlawfully removing classified information from authorized storage 
facilities, and by not storing classified information in unauthorized locations. 

In 2012, (BY was the subject of an FBI Tampa Division (FBI Tampa) 
computer intrusion investigation concerning alleged cyber stalking activity. This 
investigation was predicated on a complaint received from Witness 1. This complaint 
alleged the receipt of threatening and harassing emails from an unknown individual. 
Witness 1 claimed to have friendships with several high-ranking public and military 
officials. 

Evidence gathered during the FBI Tampa investigation indicated that someone had access 
to the personal schedule of PETRAEUS, who was then the Director of the CIA. This 
access indicated a potential breach of security. On or about June 22, 2012, FBI 
Headquarters (FBIHQ) notified PETRAEUS’s security detail of the ongoing computer 
intrusion investigation and the potential security issue. On July 19, 2012, FBI Tampa 
was notified by Witness 1 that he/she no longer wished to press charges against the cyber 
stalker. On August 10, 2012, Witness 1 informed FBI Tampa that PETRAEUS 
personally requested that Witness | withdraw his/her complaint and “‘call off the G-men.” 
On August 13, 2012, Witness 1 advised FBI Tampa that PETRAEUS believed the - 
alleged cyber stalker possessed information which could “embarrass” PETRAEUS and 
other public officials. Ultimately the FBI determined, based upon the investigation, that 


ir = was the individual who had sent the emails to Witness 1. 


. On September 24, 2012 as part of the FBI Tampa investigation, ae 


consented to a search of two laptops and two external hard drives belonging to her. A 


review of the digital media contained on these devices revealed over 100 items which 
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16, 


17. 


were identified by Charlotte Computer Analysis Response Team (CART) Forensic 
Examiners as potentially containing classified information, up to the Secret level. 

On October 26, 2012, PETRAEUS was interviewed at CIA Headquarters. PETRAEUS 
stated that he had had an extramarital affair with MD. He denied providing 
any classified documents a or having any arrangement to provide her 
with classified information. PETRAEUS stated nA may have obtained 
documents in the course of conducting research for a book she was writing. He explained 
that reporters in theater (Afghanistan), such i. were sometimes granted 
“off-the-record” access to classified presentations, such as the COMISAF’s (Commander, 
International Security Assistance Force) daily briefings. 

On November 2, 2012, FBI Tampa interviewed a. in Charlotte, North 
Carolina regarding the potentially classified documents found on her computers. She 
claimed she came into possession of several of the documents when she was in 
Afghanistan researching her book about PETRAEUS; however, she was unable to 
provide specifics as to how she obtained them. | stated that during her 
time in Afghanistan she was given access to several briefings, including at least one 
briefing at the Secret level. fr tiCS@d advised that reporters were often given such 
access in order to provide them with situational awareness of the war. In order to receive 
the briefings, signed an “off-the-record” agreement, which meant she 
could not write about classified information she observed. She stated she would 
sometimes obtain a paper copy of the briefings to preserve the information as research for 
her book. a. advised that she never received classified information from 


PETRAEUS. 
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18, During interviews conducted of IEEE. and PETRAEUS under the | 
aforementioned FBI Tampa investigation, each advised they used covert methods to 
communicate with each other. These methods included the use of email accounts using 
non-attributable names and pre-paid cellular telephones. Several of these covert email 
accounts were identified during the FBI Tampa investigation; however, it is not known if 
all the accounts were identified because both INN. and PETRAEUS stated 
they could not recall all the account names which they created and used to 
communicate. Dating Baas - September 25, 2012 interview, she advised that 

. she and PETRAEUS would sometimes share the same account, and would save messages 
to the draft folder instead of sending them via email. 

19. On November 12, 2012, Agents from the He: Tampa Divisions of the FBI 
participated in a consensual search of a: tesidence in Charlotte, North 


Carolina to recover any evidence related to cyber stalking, a violation of 18 U.S.C. 


§ 2261A, and the unauthorized removal and retention of classified documents, a violation 
of 18 U.S.C. § 1924. During the search, numerous items were seized to include digital 
media as well as four boxes and one folder of documents. On this same date, 
HD s 2<cninistrative assistant voluntarily provided the FBI with digital media 


as well as one box of documents which she maintained in her home in relation to her 


employment with JE. A review of the seized materials has identified to date 


hundreds of potentially classified documents, including more than 300 marked Secret, on 


digital images maintained on various pieces of electronic media. 
20. Of the potentially classified documents reviewed to date, the majority relate to U.S. 


military operations conducted in Afghanistan. | iS®Sd traveled into and out of 
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Afghanistan several times between September 2010 and July 2011 to conduct research 
for a biography on PETRAEUS. During this time, PETRAEUS was serving as the i 
International Security Assistance Force (ISAF) Commander. 

2 i : paper documents, digital data, and audio files indicate PETRAEUS 
played an integral role in granting access to classified information for the 


purpose of writing his biography. 


A. Communications Regarding Potential Mishandling of Classified 


Information 


22. On May 12, 2011, RB. vsing email account 


sent an email to PETRAEUS at email account 


SS) |. The subject line of the email read: “what part of 


4...” and the body of the email read: “is secret? The stuff in parenthesis, or the second 


| 
sentence?” Based on my training, experience, and information reviewed to date in this | 
investigation, your affiant believes the email related to a document or series of documents | | 
provided by PETRAEUS to NN. which contained classified information. | 
23. Between July 13, 2011 and July 15, 2011 J and a U.S, Army Lieutenant 
Colonel exchanged numerous emails. QI, using email account 


eee emailed the Lieutenant Colonel at his military email 


account, seeking information about military operations conducted by the Lieutenant 


Colonel’s unit. In requesting this information, a. noted that in the past both 
storyboards and troop narratives had been useful in conveying such facts. In an email 


from the Lieutenant Colonel to I. on July 15, 2011, he advised he was 


8 
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a2 


working on the storyboards and asked her for “a good SIPR number.” Later on July 15, 


201 1 §£ teplied to the Lieutenant Colonel’s email and carbon copied (cc’d) 
PETRAEUS at email account {i _——ES=n 
response included the following: “{I]f you have classified material, GEN Petraeus has 
been gracious enough to allow me to have you send the storyboards and material to his 
SIPR account; I’l] pick them up as soon as you send the word! I’ve copied him on this 
email. If it’s unclass, you can use my AKO or this account.” This email correspondence 
between =e and the Lieutenant Colonel likely reflects some agreement by 
PETRAEUS to provide aaa access to classified information. 


24. From June 12, 2011 through June 15, 2011, EEE using email address 


Hee 210 PETRAEUS, using email address 
ij, —— ———— || discussed several topics, to include files 


maintained by PETRAEUS. In the email string, which contained the subject line 
“Chapter 2," raised issues which PETRAEUS addressed by typing in all 
capital letters within the body of =a original emails. In the email string, 
while discussing PETRAEUS’s files, EE wrote, “[T)he Galvin letters are 
naturally very helpful in this regard (I want more of them!!! I know you’re holding 
back...)” In response to this point in = 24) email, PETRAEUS wrote: 
“THEY’RE IN BOXES AND [’LL GET THEM OUT WHEN WE UNPACK AT THE 


HOUSE IN LATE JULY/AUG.” 


? SIPR is an acronym for Secure Internet Protoco! Router network, a U.S. government 
communications system allowing the processing, storage, and communication of classified 
information up to the SECRET level. 
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25, MEM yesponded: “Thanks for your willingness to get out the boxes! c= 


Ew. the librarian at NDU, has the full collection as well, if it’s easier to just gain 


access to them there.” In response PETRAEUS wrote: “SHE DOESN’T HAVE THE 
FILES I’ VE GOT AT HOME; NEVER GAVE THEM TO HER.” 
26. In an email string initiated on or about June 19, 2011, PETRAEUS, using email address 
SSS and. using email address 
<x changed over ten emails. In the first email, with the 


subject line “Found the”, PETRAEUS discussed locating his “Galvin files” as well as 
other files and expressed his willingness to share them with i. 
PETRAEUS wrote: “[G]iven various reassurances from a certain researcher, I will not 
triage them!” Your Affiant believes the term “triage” refers to the classified contents of 
the documents. a. expressed her excitement about PETRAEUS’s 
willingness to share the files writing: “[I]’ll protect them. And I’!I protect you.” 
PETRAEUS later responded to a, writing, “[Mly files at home only go up 
to about when I took cmd of the 101", though there may be some MNSTC-I and other 
ones. Somewhere in 2003, I stopped nice filing and just started chunking stuff in boxes 


that gradually have gone, or will go, to NDU. Can search them at some point if they’re 


upstairs, but they’re not organized enough at this point.. 3 PETRAEUS continued, 
writing, “[A]nd I think MNSTC-I files went to NDU, though I’m not sure. The key to 
find there would be the weekly reports that the CIG did with me. Not sure if J kept 


copies. Class’d, but I guess I might share!” (emphasis added). 


*>MNSTC-I is an acronym for Multi-National Security Transition Command-Iraqg. MNSTC-I 
was a branch of the Multi-National Force-Iraq (MNF-I). Petraeus was the former commander of 
MNF-I. 
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27. Your affiant believes that PETRAEUS’s reference to “Class’d” means the documents he 


is discussing --- and which he indicates he is willing to provide to /= = 3 --- are 


classified. 


28, Your affiant believes PETRAEUS and [MI communicated about the sharing 


of classified information via PETRAEUS’s NIPR‘ email account. Additionally, based on ~ 


paragraph 23 above, your affiant believes PETRAEUS allowed classified documents for 
HE (0 be sent to his SIPR email abcourtt 
BACKGROUND CONCERNING NDU COLLECTION 

29. Through my training and experience, I have learned that in accordance with the 
provisions of Title 44, United States Code, Section 3301, 1, PETRAEUS transferred and 
delivered to NDU, for inclusion in the collections of NDU’s library, a collection of 
personal papers and other non-record personal property. 

30. In general, the collection is stare up of PETRAEUS’s personal files. The collection 
includes both classified and unclassified documents. The classified collection contains 
items such as reports, briefings, background material and glossaries. The unclassified 
collection includes items such as speeches, talking points to the press, newspaper articles 
and photographs. 


3 


—= 


. PETRAEUS’s physical documents were provided to NDU in September 2011. 
PETRAEUS’s electronic documents were provided to NDU in May or June 2012 via 
hard drives, 

32. PETRAEUS’s historian provided NDU with three hard drives related to PETRAEUS; 

two classified and one unclassified. The historian provided two classified hard drives as 


“NIPR is an acronym for Non-Classified Internet Protocol] Router network, a U.S. government 
communication system allowing for the exchange of sensitive but unclassified information. 
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one hard drive contained NATO classified information and the other hard drive contained 
United States classified information. Later, PETRAEUS’s historian wanted to add 
additional information to the single unclassified hard drive, therefore, PETRAEUS’s 
historian asked NDU to retum it. PETRAEUS’s historian then combined all the 
unclassified information onto a single hard drive that was provided to NDU. Both the 
unclassified hard drive and classified hard drives contain information related to 
PETRAEUS’s career, including his time as Commander of the International Security 
Assistance Force. 

33. The unclassified hard drive contained photographs, speeches made by PETRAEUS, 
newspaper articles, talking points to the press, administrative paperwork, including 
tracking calendars and orders, as well as PETRAEUS’s NIPR email. 

34. The classified hard drives primarily contain PETRAEUS’s SIPR email, as well as 
briefings, classified talking points, reference ssdctal background briefs, maps and daily 
updates. 

35. On or about August 6, 2013, NDU consented to a search of two hard drives from 
PETRAEUS’s collection. A My Book Essential hard drive, serial: WCAV5L25257IT 
and a My Book Essential hard drive, serial: WCAZA5221633 were transferred froth a 
NDU representative to FBI Agents from the Washington Field Office. The hard drives 
were then shipped to FBI Charlotte and are currently in the possession of FBI Charlotte. 
The hard drives are maintained by FBI employees not assigned to the instant matter, 

36. On or about August 22, 2013, NDU consented to a search of a My Book Essential hard 
drive, serial: WCAV5L400801T. This hard drive had been inadvertently overlooked 


‘when NDU provided consent on the other two hard drives on or about August 6, 2013. 
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37. 


38. 


39. 


Because it is probable that these drives contain email communications through 
Petraeus’s retirement from the military, there is probable cause to believe they contain 
communications between Petraeus and [EE including an email sent to Petraeus’s 
SIPR account attaching a classified document intended for delivery tol 

LOCATION TO BE SEARCHED 
I anticipate executing this warrant under the Electronic Communications Privacy Act, in 
particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A), by using the 
requested warrant to require FBI Charlotte to disclose to the government the contents of 
the hard drives described herein (including the content of communications) particularly 
described in Attachment A. Upon receipt of the information described in Attachment A, 
the information described in Attachment B will be subject to seizure by law enforcement. 
Based upon the foregoing, your affiant submits that probable cause exists for the issuance 
of a search warrant for information found on certain hard drives, as more fully described 
in Attachment A to this affidavit, stored at premises owned, maintained, controlled, or 
operated by FBI Charlotte, to search for evidence of: (a) unauthorized removal and 
retention of classified documents and material, in violation of 18 U.S.C. § 1924; (b) 


unauthorized possession and, inter alia, attempted communication and willful 


communication of national defense information to someone not entitled to receive it, as 
well as the willful retention of national defense information, in violation of 18 U.S.C. 
§ 793(e); and (c) conspiracy to commit the aforementioned crimes, in violation of 18 


USC. § 371. 
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CONCLUSION 
40. Based upon the foregoing, your affiant submits that there is sufficient probable cause to 
believe that stored on the hard drives, there exists evidence of a crime relating to: a) 
unauthorized removal and retention of classified documents and material, in otis of 


18 U.S.C. § 1924; (b) unauthorized possession and, inter alia, attempted communication 


and willful communication of national defense information to someone not entitled to’ 
receive it, as well as the willful retention of national defense information, in violation of 
18 U.S.C. § 793(e); and (c) conspiracy to commit the aforementioned ctimes, in violation 
of 18 U.S.C. § 371. 


4 


rary 


. Based on the foregoing, I request that the Court issue the requested search warrant. 
Because the warrant will be served on FBI Charlotte, who will then compile the 
requested records at a time convenient to it, there exists reasonable cause to permit the 


execution of the requested warrant at any time in the day or night. 


REQUEST FOR SEALING 


42. Since this investigation is continuing, disclosure of the search warrant, this affidavit, 
and/or this application and the attachments thereto will jeopardize the progress of the 
investigation. Accordingly, it is respectfully requested that the Court issue an order that 
the search warrant, this affidavit in support of the application for search warrant, the 
application for search warrant, and all attachments thereto be filed under seal until further 


order of this Court. 
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Respectfully submitted, 


Special Agent 
Federal Bureau of Investigation 


Sworn to and subscribed before me | 
on this, the 27 T day of September, 2013. | 


ROBERT J. CO , JR. 7 


UNITED STATHS DISTRICT COURT JUDGE 
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ATTACHMENT A 


Particular Account To Be Searched 


This warrant applies to records and other information (including the contents of 
communications) contained on the My Book Essential hard drive, serial: WCAV5L25257IT, the 
My Book Essential hard drive, serial: WCAZA5221633 and the MyBook Essential hard drive, 
serial WCAV5L400801T that are stored at premises controlled by the FBI, which accepts service 


of legal process at FBI Charlotte, Charlotte, North Carolina. 
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ATTACHMENT B 


Particular Things To Be Seized 


1, All records, information, documents and items on the hard drives that constitute 
fruits, evidence, and instrumentalities of violations of the statutes listed on the 
warrant: 

a. All records or information related to any communications between 
PETRAEUS and i : 

b. All records or information related to any communications, from December 
2008 to the present, between PETRAEUS and any other person or entity 
conceming classified and/or national defense information; . 

c, All records or information, from December 2008 to the present, related to any 
classified and/or national defense information; 

d, All records or information, from December 2008 to the present, related to the 
source(s) or potential source(s) of any classified and/or national defense 
information provided by PETRAEUS yO 

e, All records or information, from December 2008 to the present, related to the © 
state of mind of any individuals concerning the communication, disclosure, 
receipt, or retention of classified and/or national defense information; 

f. All records or information relating to knowledge of laws, rules, regulations, 
and/or procedures prohibiting the unauthorized disclosure or retention of 


classified and/or national defense information; 


17 
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g. All records or information concerning any email accounts, telephone numbers, 


or other methods of communication used by PETRAEUS; 
h. Any information recording PETRAEUS’s schedule or travel from December 
2008 to the present; 
2. As used above, the terms “records” and “information” include all of the foregoing 
items of evidence in whatever form and by whatever means they may have been 
created or stored, including any form of computer or electronic storage (such as flash 


memory or other media that can store data) and any photographic form. 


18 
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FILED 
CHARLOTTE, NC 


DEC2-0-2016 
UNITED STATES DISTRICT COURT FOR THE C : 


WESTERN DISTRICT OF NORTH CAROLINA US District c rt 
Ou 


CHARLOTTE DIVISION estern District of NC 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-279 
v. MOTION TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF AND APPLICATION 


SERIAL: WCAZA5221633, AND 
CONTENTS, AS DESCRIBED IN 
AFFIDAVIT AND ATTACHMENTS 


) 
) 
) 
MYBOOK ESSENTIAL HARD DRIVE ; 
) 
) 
INCORPORATED HEREIN. ) 


NOW COMES the United States of America, by and through Jill Westmoreland Rose, 
United States Attorney for the Western District of North Carolina, who respectfully shows unto 
the Court that on September 23, 2013, the court issued a search warrant in the above-captioned 
case and placed under seal the warrant, the application for the warrant and the affidavit in 
support of the application for the warrant; after reviewing the materials in connection with 
pending Freedom of Information Act litigation in the United States District Court for the District 
of Columbia, the United States now seeks to unseal said documents, subject to redactions of 
personal identifying information, pursuant to Local Criminal Rule 49(B) of this Court (the search 
warrant materials, as redacted by the government, are attached hereto). | 

THEREFORE, the United States respectfully moves the Court for the search warrant, the 
application for the warrant, and the affidavit in support of the application for the warrant listed 
steve be unsealed. 

Respectfully submitted, on this day of December 19, 2016. 


JILL WESTMORELAND ROSE 
UNITED STATES ATTORNEY 


/Is//TLLL WESTMORELAND ROSE 
ASSISTANT UNITED STATES ATTORNEY 
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NC Bar Number # 17656 
Attorney for USA 
Carillon Bldg, Suite 1700 
227 West Trade Street 
Charlotte, NC 28202 
Phone: 704-344-6222 
Fax: 704-344-6629 


Email: jill.rose@usdoj.gov 
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DEC 8 9 208 


UNITED STATES DISTRICT COURT FOR THE ok te debe 
WESTERN DISTRICT OF NORTH CAROLINA ee ee 


CHARLOTTE DIVISION 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-279 
v. ORDER TO UNSEAL THE 
SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF AND APPLICATION 


SERIAL: WCAZAS221633, AND 
CONTENTS, AS DESCRIBED IN 
AFFIDAVIT AND ATTACHMENTS 


) 
) 
) 
MYBOOK ESSENTIAL HARD DRIVE 
) 
) 
INCORPORATED HEREIN. ) 


UPON MOTION of the United States of America, by and through Jill Westmoreland 
Rose, United States Attorney for the Western District of North Carolina, it appearing that on 
September 23, 2013, the Court issued a search warrant in the above-captioned case and placed 
under seal the warrant, the application for the warrant, and the affidavit in support of the 
application for the warrant; it further appearing that the government, after reviewing the 
materials in connection with pending Freedom of Information Act litigation in the United States 
Court for the District of Columbia, now seeks to unseal said documents, subject to redactions of 
personal identifying information, pursuant to Local Criminal Rule 49(B) of this Court (the search 
warrant materials, as redacted by the government are attached hereto), it is hereby 

ORDERED that the search warrant, application for search warrant, and affidavit in 
support of the application for the search warrant, as redacted by the government, are hereby 
UNSEALED. 

The Clerk is directed to certify copies of this Order to the United States Attorney's 
Office. 


This the £2 ae of December, 2016. 
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AQ 93 (Rev. 12/09) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
Western District of North Carolina 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


Case No, 3: | Sm) aT] 


MyBook Essential hard drive serial: WCAZA5221633, 
and contents, as described in Affidavit and Attachments 
incorporated herein. 


SEARCH AND SEIZURE WARRANT 


weevevevew 


An application by a federal aw enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Western District of North Carolina 


(identify the person or describe the property to be searched and give its location): 
See Attachment A which is incorporated fully herein 


if 
| To: Any authorized law enforcement officer 
i 
| 


The person or property to be searched, described above is believed to conceal (identify the person or describe the 


property to be seized}: 
See Attachment B which is incorporated fully herein. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 


property. | 
YOU ARE COMMANDED to execute this warrant on or before October 4, 2013 | 

(not to exceed | 14 days) | 

O inthe daytime 6:00 a.m. to 10 p.m. & at any time in the day or night as I find reasonable cause has been 


established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
“inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge 
Robert J, Conrad, Jr. 


(name) 


C7 I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose Property, will be 
searched or seized (check the appropriate box) © for days (not to exceed 30). 


O until, the facts justifying, the later specific date of 


Date and time issued: 


Judge's signature 


City and state: Charlotte, North Carolina Robert J. Conrad, U.S. District Court Judge 
Printed name and title 


. | 
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Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


I declare under penalty of perjury that this inventory is correct and was returned along with the original 
warrant to the designated judge. 


Executing officer's signature 


Printed name and title 
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AO 106 (Rev, 04/10) Apptication for a Search Warrant 


UNITED STATES DISTRICT COURT 


for the 
Western District of North Carolina 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 


MyBook Essential hard drive, serial WCAZA5221633 as 
described in Affidavit and Attachments, incorporated fully 
herein. 


Case No. 3 : 5) a A 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See attachment A, which is incorporated fully herein. 


located in the Western District of North Carolina , there is now concealed (identify the 
person or describe the property to be seized): , 


See attachment B which fs incorporated fully herein. 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 
& contraband, fruits of crime, or other items illegally possessed; 
O property designed for use, intended for use, or used in committing a crime; 
0 a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. 1924. Unauthorized removal and retention of classified documents and materials. 
18 U.S.C. 793(e) Unauthorized possession, communication and willful retention of national defense 
information 


The application is based on these facts: 


See attached Affidavit which is incorporated fully herein 


rf Continued on the attached sheet. 


0. Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
Cortified to be atiagemh@ U-S.C. § 3103a, the basis of which is set forth on the attached sheet. 
correct copy sf Sa original. ~ 
U8, Liskict Court 


{pplicant's sig 


Diane Wehner, Special Agent, FBI 
Printed name and title 


iS) Bettore me an igned in my presence. 
pee “a3 [ou 


Date: 09/20/2013 
Judge's signature 


City and state: Charlotte, North Carolina Robert J. Conrat/ Jr., United States District Court Judge 


Printed name and title 
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AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT 


I, Diane M. Wehner, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. Imake this affidavit in support of an application for a search warrant for electronic 
information associated with certain hard drives supplied by the National Defense 
University (NDU)!. The information to be searched is described in the following 
paragraphs and in Attachment A, all incorporated fully by reference herein. 

2. Iama Special Agent with the Federal Bureau of Investigation (FBI) and have been 
employed as such for over 7 years. I have investigated matters involving complex 
financial fraud, public corruption and counterterrorism. I am currently assigned to the 
Charlotte, North Carolina FBI office. Through investigations, experience, and training, J 
have become familiar with methods and operations employed by individuals attempting 
to conceal their illegal behavior. I have also received specialized training in the proper 
collection, retention, and dissemination of classified information. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, evidentiary review, and information obtained from other Agents, government 
officials, and witnesses. This affidavit is intended to show merely that there is sufficient - 
probable cause for the requested warrant and does not set forth all of my knowledge 


about this matter. 


*NDU is an acronym for National Defense University. NDU is an institution of higher education 
funded by the United Stated Department of Defense, intended to facilitate high-level training, 
education, and the development of national security strategy. It is located on the grounds of Fort 
Lesley McNair in Washington, D.C. 


Case 3:13-mj-00279-RJC *SEALED* Document 6-2 Filed 12/20/16 Page 1 of 18 


STATUTORY AUTHORITY 

4. The FBI has been conducting an investigation of DAVID PETRAEUS and Sa 

i, | for possible violations of: (a) unauthorized removal and retention of 
classified documents and material, in violation of Title 18, United States Code, Section 


1924; (b) unauthorized possession and, inter alia, attempted communication and willful 


communication of national defense information to someone not entitled to receive it, as 
well as the willful retention of national defense information, in violation of Title 18, 
United States Code, Section 793(e); and (c) conspiracy to commit the aforementioned 
crimes, in violation of Title 18, United States Code, Section 371. 

. For the reasons set forth below, there is probable cause to believe that the electronic 
records held on the following hard drives: a My Book Essential] hard drive, serial: 
WCAV5L25257IT, a My Book Essential hard drive, serial: WCAZA5221633 and a My 
Book Essential hard drive, serial: WCAV5L400801T (all described in detail in 
Attachment A) contain evidence, fruits, and/or instrumentalities of violations of federal 


law, including, inter alia, the unlawful communication and/or retention of classified 


information. 


6. Title 18, United States Code, Section 1924{a) states: 


Whoever, being an officer, employee, contractor, or consultant of the United 
States, and, by virtue of his office, employment, position, or contract, becomes 
possessed of documents or materials containing classified information of the 
United States, knowingly removes such documents or materials without authority 
and with the intent to retain such documents or materials at an unauthorized 
location shall be fined under this title or imprisoned for not more than one year, or 
both, 


18 U.S.C. § 1924(a). 
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7. Title 18, United States Code, Section 793(e) states: 

Whoever having unauthorized possession of, access to, or contro] over any 
document, writing, code book, signal book, sketch, photograph, photographic 
negative, blueprint plan, map, model, instrument, appliance, or note relating to the 
national defense, or information relating to the national defense which 
information the possessor has reason to believe could be used to the injury of the 
United States or to the advantage of any foreign nation, willfully communicates, 
delivers, transmits or causes to be communicated, delivered, or transmitted, or 
attempts to communicate, deliver, transmit or cause to be communicated, 
delivered, or transmitted the same to any person not entitled to receive it, or 
willfully retains the same and fails to deliver it to the officer or employee of the 
United States entitled to receive it . . . shall be fined under this title or imprisoned 
not more than ten years or both. 

18 U.S.C. § 793(e). 

8. Title 18, United States Code, Section 371, makes punishable, by up to five years in 
prison, a conspiracy among two or more persons to commit any offense against the 
United States. 

9. Classified information is defined by Executive Order 13526 (E.O. 13526) and relevant 
preceding Executive Orders, as information in any form that: (1) is owned by, produced 
by or for, or under the control of the United States government; (2) falls within one or 
more of the categories set forth in the E.O. 13526; and (3) is classified by an original 
classification authority who determines that its unauthorized disclosure reasonably could 
be expected to result in damage to the national security. Where such unauthorized 
disclosure reasonably could be expected to cause “damage” to the national security, the 
information is classified as “Confidential.” Where such unauthorized disclosure 
reasonably could be expected to cause “serious damage” to the national security, the 
information is classified as “Secret.” Where such unauthorized disclosure reasonably 


could be expected to cause “exceptionally grave damage” to the national security, the 


information is classified as “Top Secret.” 
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10, Pursuant to E.O. 13526, a person may only gain access to classified information if a 
favorable determination of eligibility for access has been made by an agency head or an 
agency head’s designee, the person has signed an approved nondisclosure agreement, and 
the person has a need-to-know the information. 

PROBABLE CAUSE 

11. PETRAEUS is a retired United States Army General. From on or about October 31, 
2008 to June 30, 2010, PETRAEUS served as Commander of the United States Central 
Command. From on or about July 4, 2010 to July 18, 2011, PETRAEUS served as 
Commander of the International Security Assistance Force. From on or about September 
6, 2011 to November 9, 2012, PETRAEUS served as Director of the Central Intelligence 
Agency (CIA). At all times relevant to this affidavit, PETRAEUS held a United States 
government security clearance allowing him access to classified United States 
government information. According to a Department of Defense (DOD) official, to 
obtain that clearance, PETRAEUS was required to and would have agreed to properly 
protect classified information by not disclosing such information to persons not entitled 
to receive it, by not unlawfully removing classified information from authorized storage 
facilities, and by not storing classified information in unauthorized locations. 

. 12. i i: a researcher and author of a biography of PETRAEUS, published in 
January 2012. From on or about July 18, 2003 until on or about November 14, 2012, 
ee ee held a United States government security clearance allowing her access 
to classified United States government information. According to a DOD official, to 
obtain that clearance, Sa was required to and would have agreed to properly 


protect classified information by not disclosing such information to persons not entitled 
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to receive it, by not unlawfully removing classified information from authorized storage 
facilities, and by not storing classified information in unauthorized locations. 

13. In 2012, = was the subject of an FBI Tampa Division (FBI Tampa) 
computer intrusion investigation concerning alleged cyber stalking activity. This 
investigation was predicated on a complaint received from Witness 1. This complaint 
alleged the receipt of threatening and harassing emails from an unknown individual. 
Witness | claimed to have friendships with several high-ranking public and military 
officials. 

14. Evidence gathered during the FBI — investigation indicated that someone had access 
to the personal schedule of PETRAEUS, who was then the Director of the CIA. This 
access indicated a potential breach of security. On or about June 22, 2012, FBI | 
Headquarters (FBIHQ) notified PETRAEUS’s security detail of the ongoing computer ; | 
intrusion investigation and the potential security issue. On July 19, 2012, FBI Tampa | 
was notified by Witness 1 that he/she no longer wished to press charges against the cyber 


stalker. On August 10, 2012, Witness 1 informed FBI Tampa that PETRAEUS 


personally requested that Witness 1 withdraw his/her complaint and “call off the G-men.” 
On August 13, 2012, Witness 1 advised FBI Tampa that PETRAEUS believed the 
alleged cyber stalker rioaccsed information which could “embarrass” PETRAEUS and 
other public officials. Ultimately the FBI determined, based upon the investigation, that 
a ..:: the individual who had sent the emails to Witness 1. 

15. On September 24, 2012 as part of the FBI Tampa investigation, 
consented to a search of two laptops and two external hard drives belonging to her. A 


review of the digital media contained on these devices revealed over 100 items which 
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were identified by Charlotte Computer Analysis Response Team (CART) Forensic 
Examiners as potentially containing classified information, up to the Secret level. 


16. On October 26, 2012, PETRAEUS was interviewed at CLA Headquarters. PETRAEUS 


stated that he had had an extramarital affair vith He denied providing 
any classified documents to TO or having any arrangement to provide her i 
with classified information. PETRAEUS stated that | may have obtained 
documents in the course of conducting research for a book she was writing. He explained 
that reporters in theater (Afghanistan), such as a were sometimes granted 


“off-the-record” access to classified presentations, such as the COMISAF’s (Commander, 


International Security Assistance Force) daily briefings. 

17. On November 2, 2012, FBI Tampa interviewed in Charlotte, North 
Carolina regarding the potentially classified documents found on her computers. She 
claimed she came into possession of several of the documents when she was in 
Afghanistan researching her book about PETRAEUS; however, she was unable to 
provide specifics as to how she obtained them. [ stated that during her 
time in Afghanistan she was given access to several briefings, including at least one 
briefing at the Secret level. as advised that reporters were often given such 
access in order to provide them with situational awareness of the war. In order to receive 
the briefings, Bea signed an “off-the-record” agreement, which meant she 
could not write about classified information she observed. She stated she would | 
sometimes obtain a paper copy of the briefings to preserve the information as research for 
her book. (MMMM advised that she never received classified information from 


PETRAEUS. 
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18. During interviews conducted of ( and PETRAEUS under the 


1 


2 


\o 


oO 


aforementioned FBI Tampa investigation, each advised they used covert methods to 
communicate with each other. These methods included the use of email accounts using 
non-attributable names and pre-paid cellular telephones. Several of these covert email 
accounts were identified during the FBI Tampa investigation; however, it is not known if 
all the accounts were identified because both NNN and PETRAEUS stated 
they could not recall] all the account names which they created and used to | 
communicate. During [EERE s September 25, 2012 interview, she advised that 
she and PETRAEUS would sometimes share the same account, and would save aacisuts 


to the draft folder instead of sending them via email. 


. On November 12, 2012, Agents from the J and Tampa Divisions of the FBI 


participated in a consensual search of [NE residence in Charlotte, North 
Carolina to recover any evidence related to cyber stalking, a violation of 18 U.S.C. 

§ 2261A, and the unauthorized removal and retention of classified documents, a violation 
of 18 U.S.C. § 1924. During the search, numerous items were seized to include digital 
media as well as four boxes and one folder of documents. On this same date, 
ES adrninistrative assistant voluntarily provided the FBI with digital media 
as well as one box of documents which she maintained in her home in relation to her 
employment with M.A review of the seized materials has identified to date 
hundreds of potentially classified documents, including more than 300 marked Secret, on 


digital images maintained on various pieces of electronic media. 


. Of the potentially classified documents reviewed to date, the majority relate to U.S. 


military operations conducted in Afghanistan. HS st aveled into and out of 
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Afghanistan several times between September 2010 and July 2011 to conduct research 
for a biography on PETRAEUS. During this time, PETRAEUS ss serving as the 
International Security Assistance Force (ISAF) Commander. 

21: paper documents, digital data, and audio files indicate PETRAEUS 
played an integral role in granting IEEE access to classified information for the 


purpose of writing his biography. 


A. Communications Regarding Potential Mishandling of Classified 
Information 


22. On May 12, 2011, EE, using email account [ES 
sent an email to PETRAEUS at email account 
es " The subject line of the email read: “what part of 
4...” and the body of the email read: “is secret? The stuff in parenthesis, or the second 
sentence?” Based on my training, experience, and information reviewed to date in this 
investigation, your affiant believes the email related to a document or series of documents 
provided by PETRAEUS to EE. which contained classified information. 

23, Between July 13, 2011 and July 15, 2011, MM and a U.S. Army Lieutenant 

_ Colonel exchanged numerous emails. a. using email account 

EE .2iled the Lieutenant Colonel at his military email 
account, seeking information about military operations conducted by the Lieutenant 
Colonel’s unit. In requesting this information, noted that in the past both 
storyboards and troop narratives had been useful in conveying such facts. In an email 


from the Lieutenant Colonel to i on July 15, 2011, he advised he was 
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working on the storyboards and asked her for “a good SIPR number.” Later on July 15, 
2011, FY replied to the Lieutenant Colonel’s email and carbon copied (cc’d) 
PETRAEUS at email account [ii , rn 
response included the following: “[I]f you have classified material, GEN Petraeus has 
been gracious enough to allow me to have you send the storyboards and material to his 
SIPR account; I’1] pick them up as soon as you send the word! I’ve copied him on this 
email. If it’s unclass, you can use my AKO or this account.” This email correspondence 
between SMI and the Lieutenant Colonel likely reflects some agreement by 


PETRAEUS to provide MEE access to classified information. 


24. From June 12, 2011 through June 15, 2011, ED, using email address 


PE PETRAEUS, using email address 
| discussed several topics, to include files 


maintained by PETRAEUS. In the email string, which contained the subject line 
“Chapter 2,” BM raised issues which PETRAEUS addressed by typing in all 
capital letters within the body nimi original emails. In the email string, 
while discussing PETRAEUS’s files, I, wrote, “[T]he Galvin letters are 
naturally very helpful in this regard (I want more of them!!! J know you’re holding 
back...)” In response to this point in a: email, PETRAEUS wrote: 
“THEY’RE IN BOXES AND I’LL GET THEM OUT WHEN WE UNPACK AT THE 


HOUSE IN LATE JULY/AUG.” 


* SIPR is an acronym for Secure Internet Protocol Router network, a U.S. government 
communications system allowing the processing, storage, and communication of classified 
information up to the SECRET level. 
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25. ;si*is responded: “Thanks for your willingness to get out the boxes! 5 
i ae] the librarian at NDU, has the full collection as well, if it’s easier to just gain 
access to them there.” In passa PETRAEUS wrote: “SHE DOESN’T HAVE THE 
FILES I’ VE-GOT AT HOME; NEVER GAVE THEM TO HER.” 

26. In an email string initiated on or about June 19, 2011, PETRAEUS, using email address 
—<——_—4| |, and, using email address 
EE ¢Xchanged over ten emails. In the first email, with the 
subject line “Found the”, PETRAEUS discussed locating his “Galvin files” as well as 
other files and sipeatl his willingness to share them with —— 
PETRAEUS wrote: “[G]iven various reassurarices from a certain researcher, I will not 


ih 


triage them!” Your Affiant believes the term “triage” refers to the classified contents of 
the documents. i. expressed her excitement about PETRAEUS’s 
willingness to share the files writing: “[I]"ll protect them. And I'll protect you.” 
PETRAEUS later responded co i. writing, “[Ml]y files at home only go up 
to about when I took cmd of the 101", though there may be some MNSTC-I and other 
ones. Somewhere in 2003, I stopped nice filing and just started chunking stuff in boxes 
that gradually have gone, or will go, to NDU. Can search them at some point if they’re 
upstairs, but they’re not organized enough at this point.. 3 PETRAEUS continued, 
writing, “[AJnd I think MNSTC-I files went to NDU, though I’m not sure. The key to 
find there would be the weekly reports that the CIG did with me. Not sure if J kept 


copies. Class’d, but I guess I might share!” (emphasis added). 


° MNSTC-I is an acronym for Multi-National Security Transition Command-Iraqg. MNSTC-I 
was a branch of the Multi-National Force-Iraq (MNF-I). Petraeus was the former commander of 
MNF-I. : 


10 
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27. Your affiant believes that PETRAEUS’s reference to “Class’d” means.the documents he 
is discussing --- and which he indicates he is willing to provide to Ee are 
classified. 

28. Your affiant believes PETRAEUS and |. communicated about the sharing 
of classified information via PETRABUS’s NIPR‘ email account. Additionally, based on 
paragraph 23 above, your affiant believes PETRAEUS allowed classified documents for 

Et be sent to his SIPR email account. 
BACKGROUND CONCERNING NDU COLLECTION 

29. Through my training and experience, I have learned that in accordance with the 
provisions of Title 44, United States Code, Section 3301, 1, PETRAEUS transferred and ° 
delivered to NDU, for jachision in the collections of NDU’s library, a collection of 
personal papers and other non-record personal property. 

30. In general, the collection is made up of PETRAEUS’s personal files. The collection 
includes both classified and unclassified documents. The classified collection contains 
items such as reports, briefings, background material and glossaries. The unclassified 
collection includes items such as speeches, talking points to the press, newspaper articles 
and photographs. 


3 


— 


. PETRAEUS’s physical documents were provided to NDU in September 2011. 
PETRAEUS’ electronic documents were provided to NDU in May or June 2012 via 
hard drives, 

32, PETRAEUS’s historian provided NDU with three hard drives related to PETRAEUS; 


two classified and one unclassified. The historian provided two classified hard drives as 


“NIPR is an acronym for Non-Classified Internet Protocol Router network, a U.S, government 
communication system allowing for the exchange of sensitive but unclassified information. 


11 
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one hard drive contained NATO classified information and the other hard drive contained - 
United States classified information. Later, PETRAEUS’s historian wanted to add 
additional information to the single unclassified hard drive, therefore, PETRAEUS’s 
historian asked NDU to return it. PETRAEUS’s historian then combined all the 
unclassified information onto a single hard drive that was provided to NDU. Both the 
unclassified hard drive and classified hard drives contain information related to 
PETRAEUS’s career, including his time as Commander of the International Security 
Assistance Force. 

33. The unclassified hard drive contained photographs, speeches made by PETRAEUS, 
newspaper articles, talking points to the press, administrative paperwork, including 
tracking calendars and orders, as wel] as PETRAEUS’s NIPR email. 

34, The classified hard drives primarily contain PETRAEUS’s SIPR email, as well as 
briefings, classified talking points, reference material, background briefs, maps and daily 
updates. 

35. On or about August 6, 2013, NDU consented to a search of two hard drives from 
PETRAEUS’s collection. A My Book Essential hard drive, serial: WCAV5L25257IT 
and a My Book Essential hard drive, serial: WCAZA5221633 were transferred from a 
NDU representative to FBI Agents from the Washington Field Office. The hard drives 
were then shipped to FBI Charlotte and are currently in the possession of FB] Charlotte. 
The hard drives are maintained by FBI employees not assigned to the instant matter. 

36, On or about August 22, 2013, NDU consented to a search of a My Book Essential hard 
drive, serial: WCAV5L400801T. This hard drive had been inadvertently overlooked 


when NDU provided consent on the other two hard drives on or about August 6, 2013. 
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_ 37, Because it is probable that these drives contain email communications through 


3 


oo 


Petraeus’s retirement from the military, there is probable cause to believe they contain 
communications between Petraeus and including an email sent to Petraeus’s 
SIPR account attaching a classified document intended for delivery to [A 


LOCATION TO BE SEARCHED 


. Lanticipate executing this warrant under the Electronic Communications Privacy Act, in 


particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1 (A), by using the 
requested warrant to require FBI Charlotte to disclose to the government the contents of 
the hard drives described herein (including the content of communications) particularly 
described in Attachment A. Upon receipt of the information described in Atsdinieht A, 


the information described in Attachment B will be subject to seizure by law enforcement. 


39. Based upon the foregoing, your affiant submits that probable cause exists for the issuance 


of a search warrant for information found on certain hard drives, as more fully described 
in Attachment A to this affidavit, stored at premises owned, maintained, controlled, or 
operated by FBI Charlotte, to search for evidence of: (a) unauthorized removal and 
retention of classified documents and material, in violation of 18 U.S.C. § 1924; (b) 
unauthorized possession and, inter alia, attempted communication and willful 
communication of national defense information to someone not entitled to receive it, as_ 
well as the willful retention of national defense information, in violation of 18 U.S.C. 

§ 793(e); and (c) conspiracy to commit the aforementioned crimes, in violation of 18 


USS.C. § 371. 
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| 

CONCLUSION | 
40. Based upon the foregoing, your affiant submits that there is sufficient probable cause to | 
| 


believe that stored on the hard drives, there exists evidence of a crime relating to: a) 


unauthorized removal and retention of classified documents and material, in violation of | 


18 U.S.C. § 1924; (b) unauthorized pieeiion and, inter alia, attempted communication 
and willful communication of national defense information to someone not entitled to 
receive it, as well as the willful retention of national defense information, in violation of 
18 U.S.C. § 793(e); and (c) conspiracy to commit the aforementioned crimes, in violation 
of 18 U.S.C. § 371. 


4 


nary 


. Based on the foregoing, I request that the Court issue the requested search warrant. 
Because the warrant will be served on FBI Charlotte, who will then compile the 
requested records at a time convenient to it, there exists reasonable cause to permit the 


execution of the requested warrant at any time in the day or night. 


REQUEST FOR SEALING 


42. Since this investigation is continuing, disclosure of the search warrant, this affidavit, 
and/or this application and the attachments thereto will jeopardize the progress of the ' 
investigation. Accordingly, it is respectfully requested that the Court issue an order that 
the search warrant, this affidavit in support of the application for search warrant, the 
application for search warrant, and all attachments thereto be filed under seal until further 


order of this Court. 
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Respectfully submitted, 


Special Agent 
Federal Bureau of Investigation 


Swom to and subscribed before me 
on this, the OT day of September, 2013. 


fledoe- J.CO 
UNITED pints DISTRICT COURT JUDGE 
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ATTACHMENT A 


Particular Account To Be Searched 


This warrant applies to records and other information (including the contents of 
communications) contained on the My Book Essential hard drive, serial: WCAV5L25257IT, the 
My Book Essential hard drive, serial: WCAZA5221633 and the MyBook Essential hard drive, 
serial WCAVSL400801T that are stored at premises controlled by the FBI, which accepts service 


of legal process at FB] Charlotte, Charlotte, North Carolina. 
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ATTACHMENT B 


Particular Things To Be Seized 


1, All records, information, documents and items on the hard drives that constitute 
fruits, evidence, and instrumentalities of violations of the statutes listed on the 
warrant: 

a. All records or information related to any communications between 
PETRAEUS and Sa 

b. All records or information related to any communications, from December 
2008 to the present, between PETRAEUS and any other person or entity 

. concerning classified and/or national defense information; 

c. All records or information, from December 2008 to the present, related to any 
classified and/or national defense information; 

d. All records or information, from December 2008 to the present, related to the 
source(s) or potential source(s) of any classified and/or national defense 
information provided by PETRAEUS to a ee 

e. All records or information, from December 2008 to the present, related to the 
state of mind of any individuals concerning the communication, disclosure, 
receipt, or retention of classified and/or national defense information; 

f. All records or information relating to knowledge of laws, rules, regulations, 
and/or procedures prohibiting the unauthorized disclosure or retention of 


classified and/or national defense information; 
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g. All records or information conceming any email accounts, telephone numbers, 


or other methods of communication used by PETRAEUS; 


h. Any information recording PETRAEUS’s schedule or travel from December 


2008 to the present; 


2. As used above, the terms “records” and “information” include al] of the foregoing 


items of evidence in whatever form and by whatever means they may have been 


created or stored, including any form of computer or electronic storage (such as flash 


memory or other media that can store data) and any photographic form. 
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FILED 
CHARLOTTE, NC 


DEC 20 2018 
UNITED STATES DISTRICT COURT FOR THE 
WESTERN DISTRICT OF NORTH CAROLINA US District Court 


CHARLOTTE DIVISION Western Distriat of NG 
UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-99 
v. ) MOTION TO UNSEAL THE 
) SEARCH WARRANT, AFFIDAVIT 

IN THE MATTER OF THE SEARCH OF ) AND APPLICATION 
_ THE PREMISES LOCATED AT ‘ Te 

AS DESCRIBED IN AFFIDAVIT AND ) 

ATTACHMENT INCORPORATED ) 

HEEREIN. ) 


NOW COMES the United States of America, by and through Jill Westmoreland Rose, 
United States Attorney for the Western District of North Carolina, who respectfully shows unto 
the Court that on April 4, 2013, the court issued a search warrant in the above-captioned case and 
placed under seal the warrant, the application for the warrant and the affidavit in support of the 
application for the warrant; after reviewing the materials in connection with pending Freedom of 
Information Act litigation in the United States District Court for the District of Columbia, the 
United States now seeks to unseal said documents, subject to redactions of personal identifying 
information, pursuant to Local Criminal Rule 49(B) of this Court (the search warrant materials, 
as redacted by the government, are attached hereto). 

THEREFORE, the United States respectfully moves the Court for the search warrant, the 
application for the warrant, and the affidavit in support of the application for the warrant listed 
above be unsealed. 

Respectfully submitted, on this day of December 19, 2016. 


JILL WESTMORELAND ROSE 
UNITED STATES ATTORNEY 


/s//1LL WESTMORELAND ROSE 
ASSISTANT UNITED STATES ATTORNEY 
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NC Bar Number # 17656 
Attorney for USA 
Carillon Bldg, Suite 1700 
227 West Trade Street 
Charlotte, NC 28202 
Phone: 704-344-6222 
Fax: 704-344-6629 


Email: jill.rose@usdoj.gov 
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UNITED STATES DISTRICT COURT FOR THE 
WESTERN DISTRICT OF NORTH CAROLINA 
CHARLOTTE DIVISION" 
‘UNITED STATES OF AMERICA ) DOCKET NO.: 3:13-mj-99 
v. ) ORDER TO UNSEAL THE 
) SEARCH WARRANT, AFFIDAVIT 
IN THE MATTER OF THE SEARCH OF ) AND APPLICATION 
THE PREMISES LOCATED AT — st 
AS DESCRIBED IN AFFIDAVIT AND ) 
ATTACHMENT INCORPORATED ) 
HEEREIN. ) 


UPON MOTION of the United States of America, by and through Jill Westmoreland 
Rose, United States Attorney for the Western District of North Carolina, it appearing that on 3 
April 4, 2013, the Court issued a search warrant in the above-captioned case and placed under 
seal the warrant, the application for the warrant, and the affidavit in support of the application for 
the warrant; it further appearing that the government, after reviewing the materials in connection 
with pending Freedom of Information Act litigation in the United States Court for the District of 
Columbia, now seeks to unseal said documents, subject to redactions of personal identifying 
information, pursuant to Local Criminal Rule 49(B) of this Court (the search warrant materials, 
as redacted by the government are attached hereto), it is hereby 

ORDERED that the search warrant, application for search warrant, and affidavit in 
support of the application for the search warrant, as redacted by the government, are hereby 
UNSEALED. 

The Clerk is directed to certify copies of this Order to the United States Attorney's 
Office. 


This the ia O say of December, 2016. 


PR gt 
UNITED STATES NINE aT Aen 
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AO 106 (Rev, 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT. 


; for the ; : FILED 
Western District of North Carolina CHARLOTTE, NC 
, 
In the Matter of the Search of. ) APR 4 2013 
Bi describe th b hed ‘ 
os ‘dena the pie aps tf dg pots ; Case No, % 14, Mm 4 4 
The Premises Located at : } | Wi US District Court 
as described in Affidavit ) estern District of NC 


and Attachments, incorporated herein. 
APPLICATION FOR A SEARCH WARRANT 
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 


penalty of perjury that I have reason to believe that on the following person or property (identity the person or describe the 


ts locati 
Py eg Ne ment / 4 ant eiseareatated fully herein. 


located in the Western District of North Carolina , there is, now concealed (identify the 


person or describe the property to be seized): 
See Attachment B, which is Incorporated fully herein. 


Certified to be a true and 
correct copy of the original, 
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): US. Detrict Court 
@ evidence of a crime; - Frank G. Johns, Clerk 
wf contraband, fruits of crime, or ie items illegally possessed; Westem District ot W.C. 


OC property designed for use, intended for use, or used in committing a crime; By aaa 


O a person to be arrested or a person who is unlawfully restrained. iy 
. Deie oem 
The search is related to a violation of: ia Pere 


Code Section Offense Description : 
18 USC 1924; 18 USC 793(e); Unauthorized removal and retention of classified documents or material; , 
18 USC 371 Unauthorized possession, communication, and willful retention of national defense 


information; Conspiracy 


The application is based on these facts: 


cil Continued on the attached sheet. 


0 Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached WH 


] fd ie 's Ll 


Gerd J. Ballner, Special Agent, FBI 
Printed name and title 


Judge's signature 


Sworn to before me and signed in my presence. 


Date: 04/03/2013 


City and state: Charlotte, North Carolina ___ Robert J, Conr 


Jr., United States District Qourt Judge 
Printed name and title : 
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AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT - 


I, Gerd J. Ballner, Jr., being first duly sworn, hereby depose and state as follows: 


INTRODUCTION AND AGENT BACKGROUND 


1, Imake this affidavit in support of an application for a warrant to search the residence of 
RS, «siding t 
HR. The premises to be searched and items to be seized are more fully 
described in Attachments A and B. 

2. Tama Special Agent with the Federal Bureau of Investigation (FBI) and have been 
employed as such for approximately thirteen years. I have investigated matters involving 
National Security to include Counterintelligence and Espionage. I am currently assigned 
to the Charlotte, North Carolina FBI office. Through investigations, experience, and 
training, I have become familiar with methods and operations employed by hostile 
foreign intelligence services and their recruited human sources to illegally obtain, through 
clandestine action, classified and proprietary information, which if compromised poses 
risk to the national security of the United States. I have also ceive specialized training 
in the proper collection, retention, and dissemination of classified information. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, evidentiary review, and Sateenalion obtained from other Agents, government 
officials, and witnesses. This affidavit is intended to show merely that there is sufficient 
probable cause for the requested warrant and does not set forth all of my knowledge 


af 


about this matter. 
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LOCATION TO BE SEARCHED 


4. As set forth below, your affiant submits that probable cause exists for the issuance of a 
search warrant for HE cesidence, as more fully destined in Attachment A 
to this affidavit, to search for evidence of: (a) unauthorized removal.and retention of 
classified documents and material, in violation of 18 U.S.C. § 1924;'(b) unauthorized 


possession and, inter alia, attempted communication and willful communication of 


national defense information to someone not entitled to receive it, as well as the willful 
retention of national defense information, in violation of 18 U.S.C. § 793(e); and (c) 
conspiracy to commit the aforementioned crimes, in violation of 18 U.S.C. § 371. 

5. On March 29, 2013, your affiant conducted a search of the CLEAR public source 
database for MN and determined that her current sive of record is 
aS ae ee ee According to 2011 tax records 
filed in Rictienbiae County, North Carolina, this home is owned by [ijand Ha 
BR 206 it is further described as i 
HE. Thc house number MEBs visible as brass numerals on 


the molding above the front entry door. 


STATUTORY AUTHORITY 


6. The FBI has been conducting an investigation of NM for possible 


violations of: (a) unauthorized removal and retention of classified documents and 


material, in violation of Title 18, United States Code, Section 1924; (b) unauthorized 


possession and, inter alia, attempted communication and willful communication of 


national defense information to someone not entitled to receive it, as well as the willful 


retention of national defense information, in violation of Title 18, United States Code, 
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Section 793(e); and (c) conspiracy to commit the aforementioned crimes, in violation of 
Title 18, United States Code, Section 371. 
7. Title 18, United States Code, Section 1924(a) states: 


Whoever, being an officer, employee, contractor, or consultant of the United 
States, and, by virtue of his office, employment, position, or contract, becomes 
possessed of documents or materials containing classified information of the 
United States, knowingly removes such documents or materials without authority 
and with the intent to retain such documents or materials at an unauthorized 
location shall be fined under this title or imprisoned for not more than one year, or 
both. 


18 U.S.C. § 1924(a). 

8. Title 18, United States Code, Section 793(e) states: 

Whoever having unauthorized possession of, access to, or control over any 
document, writing, code book, signal book, sketch, photograph, photographic 
negative, blueprint plan, map, model, instrument, appliance, or note relating to the 
national defense, or information relating to the national defense which 
information the possessor has reason to believe could be used to the injury of the 
United States or to the advantage of any foreign nation, willfully communicates, 
delivers, transmits or causes to be communicated, delivered, or transmitted, or 
attempts to communicate, deliver, transmit or cause to be communicated, 
delivered, or transmitted the same to any person not entitled to receive it, or 
willfully retains the same and fails to deliver it to the officer or employee of the 
United States entitled to receive it... shall be fined under this title or imprisoned 
not more than ten years or both. 

18 U.S.C. § 793(e). 

9, Title 18, United States Code, Section 371, makes punishable, by up to five years in 
prison, a conspiracy among two or more persons to commit any offense against the 
United States. 

10. Classified information is defined by Executive Order 13526 (E.O. 13526) and relevant 
preceding Executive Orders, as information in any form that: (1) is owned by, produced 


by or for, or under the control of the United States government; (2) falls within one or 


more of the categories set forth in the E.O, 13526; and (3) is classified by an original 
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_ classification authority who determines that its unauthorized disclosure reasonably could 


be expected to result in damage to the national security. Where such unauthorized 


disclosure reasonably could be expected to cause “damage” to the national security, the I 


information is classified as “Confidential.” Where such unauthorized disclosure 


reasonably could be expected to cause “serious damage” to the national security, the 
information is classified as “Secret.” Where such unauthorized disclosure reasonably 
could be expected to cause “exceptionally grave damage” to the national security, the 
information is classified as “Top Secret.” 


] 


= 


. Pursuant to E.O, 13526, a person may only gain access to classified information ifa 
favorable determination of eligibility for access has been made by an agency head or an 
agency head’s designee, the person has signed an approved nondisclosure agreement, and 
the person has a need-to-know the information. 

PROBABLE CAUSE 
12. David Petraeus is a retired United States Army General. From on or about October 31, 


2008 to June 30, 2010, Petraeus served as Commander of the United States Central 


Command. From on or about July 4, 2010 to July 18, 2011, Petraeus served as | 


Commander of the International Security Assistance Force. From on or about September 


6, 2011 to November 9, 2012, Petraeus served as Director of the Central Intelligence 
Agency (CIA). At all times relevant to this affidavit, Petraeus held a United States 
government security clearance allowing him access to classified United States 
government information. According to a Department of Defense (DOD) official, to 
obtain that clearance, Petraeus was required to and would have agreed to properly protect 


classified information by not disclosing such information to persons:not entitled to 
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receive it, by not unlawfully removing classified information from anthesis storage 
facilities, and by not storing classified information in unauthorized locations. 

13. FY is a researcher and author of a biography of Petraeus, published in 
January 2012. From on or about July 18, 2003 until on or about November 14, 2012, 
aa held a United States government security clearance allowing her access 
to classified United States government information. According to a DOD official, to 
obtain that clearance, iE was required to and would have agreed to properly 
protect classified information by not disclosing such information to persons not entitled 
to receive it, by not unlawfully removing classified information from authorized storage 
facilities, and by not storing classified information in unauthorized Iboations. 

| 14. In June 2012, the FBI’s Tampa Division (FBI Tampa) opened a computer intrusion 
investigation concerning alleged cyber stalking activity. This investigation was 


predicated on a complaint received from Witness 1, which alleged the receipt of 


threatening and harassing emails from the email addresses S| and 
eae Witness 1 claimed friendships with several high-ranking 


public and military officials, 


1 


wm 


. Evidence gathered during the FBI Tampa investigation indicated that someone had access 
to the personal schedule of Petraeus, who was then the Director of the CIA. This access 
indicated a potential breach of security. On or about June 22, 2012, FBI Headquarters 
(FBIHQ) notified Petraeus’s security detail of the ongoing computer intrusion 
investigation and the potential security issue. On July 19, 2012, FBI Tampa was notified 
by Witness 1 that he/she no longer wished to press charges against the cyber stalker. On’ 


August 10, 2012, Witness 1 informed FBI Tampa that Petraeus personally requested that 
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Witness 1 withdraw his/her complaint and “call off the G-men.” On August 13, 2012, 
Witness 1 advised FBI Tampa that Petraeus believed the alleged cyber stalker possessed 


information which could “embarrass” Petraeus and other public officials. 


16. Investigation conducted by FBI Tampa identified f= ee as the person 


suspected of using the email accounts i 224 
ee. Investigation also determined =i uses the email 


account as On September 24, 2012, FBI Tampa interviewed 
Ht her residence. During this interview a admitted sending 
the emails to Witness 1, as well as other emails regarding Witness 1 ‘to senior United 
States military officers as well as a foreign diplomat. je also stated that she 
had engaged in an extramarital affair with Petraeus, ———— provided consent to 
search two of her laptop computers and two external hard drives. 


17, On September 25, 2012, FB] Tampa returned SE laptop computers and 


~~ 


conducted a follow-up interview. During this follow-up interview, Ss 
admitted she told Petraeus that he should get Witness | to “drop the charges.” 
Saaz ed she does not know if Petraeus made the request of Witness 1. 
During the course of this interview, EEE provided interviewing agents consent 
to search her Apple iPhone, which she had in her possession. FBI Charlotte Computer 
Analysis Response Team (CART) Forensic Examiners copied the contents of her Apple 
iPhone at the interview location. This iPhone, serial number C28J60GKDTDD, is 


believed to be the same iPhone currently iii possession. It was returned 
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to BE at the conclusion of the interview.’ A review of fo 


laptops and external hard drives located over 100 items which were identified by 
Charlotte CART Forensic Examiners as containing potentially classified information, 
including information up to the Secret level. 

18. On October 26, 2012, Petraeus was interviewed at CLA Headquarters. Petraeus stated 
that he had had an extramarital affair with (NM). He denied providing any 
classified documents to [nope or having any arrangement to provide her with 
classified information. Petraeus stated that ME may have obtained 
documents in the course of conducting research for a book she was writing. He explained 
that reporters in theater (Afghanistan), such as a. were sometimes granted 
“off-the-record” eee to classified presentations, such as the COMISAF’s (Commander, 
International Security Assistance Force) daily briefings. 

19. On November 2, 2012, FBI Tampa interviewed EE in Charlotte, North 
Carolina regarding the potentially classified documents found on her computers. She 
claimed she came into possession of several of the documents when she was in 
Afghanistan researching her book about Petraeus; however, she was unable to provide 
specifics as to how she obtained them. ae stated that during her time in 
Afghanistan she was given access to several briefings, including at least one briefing at 
the Secret level, a advised that reporters were often given such access in 
order to provide them with situational awareness of the war. In order to receive the 
briefings, ee ay signed an “off-the-record” agreement, which meant she could 
not write about classified information she observed. She stated she would sometimes 


* Because the consensual search of the iPhone was conducted as part of FBI: Tampa’s computer 
intrusion investigation, FBI Charlotte has not reviewed the forensic images of the iPhone. 
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obtain a paper copy of the briefings to preserve the information as research for her book. 
HR advised that she never received classified information from Petraeus. 

20. During interviews conducted of EY and Petraeus under the aforementioned 
FBI Tampa investigation, each advised they used covert methods to'‘communicate with 
one another. These methods included the use of pre-paid cellular telephones and email 
accounts using non-attributable names. Several of these covert email accounts were 
identified during the FBI Tampa investigation; however, it is not known if all the 
accounts were identified because both a: Petraeus stated they én not 
recall all the account names which they created and used to communicate. During 
aes September 25, 2012 intensiews she advised that she and Petraeus anid 
sometimes share the same account, and would save messages to the draft folder instead of 
sending them via email. 

A. ER Consensual Search, November 12, 2012 


2 


saat 


. As a result of finding potentially classified information on the laptops provided by 
aa. FBI Tampa and FBI Charlotte conducted a consensual search of 
| Charlotte residence on November 12, 2012 to recover any evidence 
related to cyber stalking, in violation of 18 U.S.C. § 2261A, and the unauthorized 
removal and retention of classified documents or material, in violation of 18 U.S.C. 

§ 1924. On this same date, a consensual search was also conducted at the residence of 
ME oc:inistrative assistant, NE, in, Concord, North 
Carolina. BR vo wntarily provided the FBI with various items she maintained in 
her home in relation to her employment with ES. During the searches, 


additional paper documents were found, some of which, upon belief and information of 
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your affiant, are classified. Asa result of the two searches, the following digital media 
were seized: eight computers, twelve external hard drives, two pitiderehsancars: two 
cellular telephones, two Apple iPods, seven thumbdrives/memory cards, and 
approximately fifty floppy discs, CDs, and optical discs. 

22. Based on a preliminary review of SEN digital media, it'is believed she came 
into possession of potentially classified information both before ud during the writing of 
her book, “All In: The Education of General David Petraeus.” Of the potentially 
classified documents reviewed to date, the majority relate to U.S. military operations 
conducted in Afghanistan, Given her extensive use of digital media, your affiant believes 
Pt received/exchanged classified information via email and/or made contact 
with individuals via email and/or telephone to schedule in-person si dios for the 
purpose of recording and collecting classified information, as detailed below. 
HR 5s also believed to have di gitally stored numerous documents, 
photographs, and audio interviews which contain classified eieantie 
B. Additional Evidence of Potential Mishandling of Classified jaforiention 


2 


we 


_ A review of ME digital media has identified photographs of at least two 
black books, which appear to be the daily event and calendar books used. by Petraeus . 
to memorialize significant events during his military assignments.” ieivestipators have 
reviewed the metadata from some of the digital media obtained doterisitally from 
HE 20.0 have determined that from on or about August 29, 2011 to on or 


about August 31, 2011 , there were approximately one hundred and seventeen separate 


* Based on a review of these photographs and their embedded metadata, your affiant believes that 
all of the photographs referenced in paragraphs 23 through 28 of this affidavit were taken using 
BEE 1 P hone. , 
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photographs taken of the contents of the black books, These photographs have been 


reviewed by your affiant in close coordination with other government agencies 


= Webi ae Briss 


designated to assist with this investigation. Based upon a preliminary review by another 


government agency designated to assist in this investigation, your affiant has reason to 


believe that at least five of these photographs contain classified information, including 
information up to the Top Secret level. . 

24. Additional review of embedded metadata, including date and time stamps, allowed i 
investigators to identify specific photographs from [NM digital media. On 

. August 29, 2011, at 9:47 a.m., two photographs were taken of the front cover of a black 

book which had Petraeus’s personal business card taped to the front cover. The business 
card identified Petraeus as “General David H. Petraeus, Commander, Intemational 
Security Assistance Force.” 

25. Open source information includes a photograph depicting Petraeus with a black book. 


See www.thedailybeast.com/newsweek/201 1/07/ 17/general-david-petraeus-on-leaving- 


afghanistan-and-going-to-cia.html. Based on my review, I believe that the black book 


depicted in the photographs described in paragraph 24 above is the same black book 
depicted in the photograph of Petraeus in the news article on the above-mentioned 
website. The photograph shows Petraeus, while in Afghanistan, standing with then- 
Secretary of Defense Leon Panetta and General John Allen. This photograph, dated July 
9, 2011, reportedly captured Petraeus while he was ending his command in Afghanistan. 
On the table next to Petraeus in the same photograph, is a similarly sized black book with 
a business card taped to the front. The format of the business card, its position on the 


book; the manner in which it is taped to the book, and its general characteristics are very 
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similar to the photographs of the front cover of a black book located on 
digital media. 
26. Photographs of what appear to be this same black book were taken on August 30, 2011 at 
11:21 am., 11:22 a.m,, 11:28 am., 12:09 p.m, and on August 31, 2011 at 6:15 a.m. 
Based upon a preliminary review by another government agency designated to assist with 
this investigation, your affiant has reason to believe these photographs depict pages from 
the black books containing classified information, including classified information at up 
to the Top Secret level. 
27. An 8.5 x 11 inch sized printed photograph was located during the consensual search of 
HR ce sidence on November 12, 2012. This photograph showed the content 
of a black book, specifically a page containing a daily calendar for December 3, 2010 on 
the left side of the notebook and handwritten notes on the right side of the notebook, The 
written entry on the top line read, “ME: C-N Community of Tnteredt.” The calendar in 
the photograph reflected a “CN Briefing” between 1:45 p.m. and 2:30 p.m. on December 
3, 2010. Your affiant opines that the written note for A was added by Petraeus 
so as to provide EEE, context in reading that day’s calendar entry. An initial 
review of the calendar and notes on this specific image revealed a reference to military 


units and potential needs for these units. 


28. Additional review of MIN digital media also revealed multiple photographs 
taken between August 16, 2011 and August 17, 2011. On review of the photographs and 
the embedded metadata, investigators have determined the following: 

a, On August 16, 2011 at 11:04 p.m., a photograph was taken of at least three 


medium-sized cardboard boxes sitting on a bed. In the photograph, the boxes are © 
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open, and although the contents are unknown, there appear to be some file folders 
visible inside the boxes. Sitting on the bed next to the boxes is a black laptop 
computer which is open and powered on, though the screen image is difficult to 
discern, 

b. On August 16, 2011 at 11:04 p.m., a second photograph from a different angle 
was taken of the same boxes referenced above. The boxes are open, and one box 
has the letters “Petrae” written in black and clearly visible on the side. Your 
affiant believes this writing spelled out “Petraeus,” as the “us” in “Petraeus” was 
partially obscured. 

c. On August 17, 2011 at 9:23 a.., EE is observed in a photograph 
which she took of herself in a mirror. In the photo graph, iT is 
posing next to the same bed mentioned in paragraphs 33a and 33b above. In this 
photograph, what appear to be two of the same boxes are visible on the bed. The 
boxes are open, though the contents of the boxes cannot be clearly discemed. 

C. Continuing Communications Between Hs 2 Petraeus 

29. i. = Su and Petraeus are believed to have had multiple telephonic contacts after 
each was made aware of FBI Tampa’s computer intrusion investigation. Your affiant 
asserts: 

a. Petraeus’s CIA security detail was notified of the FBI investigation on June 22, 
2012. In an interview with FBI Tampa on October 26, 2012, Petraeus 
acknowledged that: (1) he was briefed by the security detail concerning the FBI 
investigation, and (2) he called MM on June 23, 2012 regarding the 


emails received by Witness 1. 
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b. Over the weekend of August 11, 2012 and August 12, 2012, Petraeus spoke to 
‘Witness 1, In evidence reviewed by FBI Charlotte, a telephone number attributed 
to called a telephone number attributed to Petraeus on August 11, 
2012.3 
c. EER was interviewed by FBI Tampa on September 24, 25, and 26, 
2012. A telephone number attributed to called a telephone 
number attributed to Petraeus on three occasions on September 25, 2012. 
d. HEE was in contact with FBI Tampa on October | and 2, 2012. These 
contacts ultimately resulted in a telephone interview conducted on October 3; 
2012. In evidence reviewed by FBI Charlotte, on October 2,-2012, there were six 


calls between telephone numbers attributed to MBM and Petracus. One 
of these calls connected, resulting in an approximately fice thin iana 
conversation. 

e. During the October 26, 2012 interview of Petraeus by FBI Tarana he stated that, 
while coming back from a trip to the Far East earlier in the rrcith, he called 
HE | who told him about her interview with the FBI. Evidence 
indicated that a telephone number attributed to Petraeus called a telephone 
number attributed to [EMMY on October 16, 2012. 

f. Following FBI Tampa's interview of Petraeus on October 26, 2012, a telephone 
number attributed to called a telephone number attributed to 
Petraeus on four occasions on October 27, 2012, on three Gceasieas on October 
28, 2012, and on two occasions on October 29, 2012. 


* Unless otherwise noted. the “telephone number associated with MED in these 
subparagraphs was }, the mobile telephone number used on her current iPhone. 
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g. On November 2, 2012, ae was again interviewed by FBI Tampa. 
WEEE stated that she and Petraeus had talked candidly since each of 
their interviews with the FBI. : 

h. On November 9, 2012, MM. contacted FBI Tampa telephonically from 
telephone number ee. She advised she received a telephone call 
from Petraeus earlier that day advising her of his resignation. In evidence 
reviewed by FBI Charlotte, telephone number «21-3 a telephone 
number attributed to Petraeus on November 9, 2012. . 

30. The foregoing telephone communications identified in this affidavit ily include calls 
made or received from one government phone attributed to Petraeus. As detailed above, 
Petraeus and FY have previously been in regular contact through email, and 
eoiinaaee about the provision of classified information to oe 
Moreover, , and Petraeus have admitted that they etal covert 
communications systems using pre-paid cellular telephones and non-attributable email 
accounts. To date, the pre-paid telephone numbers used by Petraeus and a al 
have not been identified. 


3 


— 


. These telephonic contacts and attempted telephonic contacts between telephone numbers 


attributed to ae: Petraeus indicate Fs relationship with 
Petraeus continued after their interviews with FBI Tampa in September and October 
2012, 

32, Considering these facts, and given (EE history of email and telephone 
communication with Petraeus, as well as the numerous photographs of what, based on a 


preliminary review, appear to be classified materials, there is probable cause to believe 
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33, 


34. 


3 


un 


that | iPhone contains classified information as well as substantive 
communications regarding the content of MEE and Petraeus’s FBI 
interviews, including additional information regarding ‘<>. s| access to and 
retention of classified information. 

During fie cohscyesl search of [ME Charlotte residence on November 12, 
2012, investigators recovered a damaged Apple iPhone, serial number 61116264A4S. 
Many of the photographs of the black books and cardboard boxes referenced above were 
located on this damaged iPhone. A review of voicemail and call logs indicates that the 
damaged iPhone was last used by EEE in Apri! 2012. 

Based on your affiant’s experience, Apple iPhones allow for the transfer of a user’s 
contents from one telephone to another. It is plausible that | when she 
ceased using the damaged iPhone, would have transferred data on her damaged iPhone 
to her current iPhone. Since the damaged iPhone contained photographs of what, based 
on a preliminary review, appear to be classified materials, and with the potential for 
transfer of data to her current iPhone, there is probable cause to believe that these 


photographs were transferred to the iPhone currently in i ——— ail possession. 


TECHNICAL TERMS RELATED TO THE SEARCH 


. Based on my training and experience, I use the following technical terms to convey the 


following meanings: 
a, Wireless telephone: A wireless telephone (or mobile telephone, or cellular 
telephone) is a handheld wireless device used for voice and data communication 
through radio signals. These telephones send signals through networks of 


transmitter/receivers, enabling communication with other wireless telephones or 
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traditional “land line” telephones. A wireless telephone usually contains a “call 
log,” which records the telephone number, date, and time of calls made to and 
from the phone. In addition to enabling voice communications, wireless 
telephones offer a broad range of capabilities. These capabilites include: storing 
names and phone numbers in electronic “address books;” sending, receiving, and 
storing text messages and e-mail; taking, sending, receiving, and storing still 
photographs and moving video; storing and playing back audio files; storing 
dates, appointments, and other information on personal calendars; and accessing 
and downloading information from the Internet. Wireless telephones may also 
include global positioning system (“GPS”) technology for determining the 
location of the device. , 

b. Digital camera: A digital camera is a camera that records pictures as digital 
picture files, rather than by using photographic film. Digital cameras use a 
variety of fixed and removable storage media to store their recorded images. 
Images can usually be retrieved by connecting the camera to.a computer or by 
connecting the removable storage medium to a separate reader, Removable 
storage media include various types of flash memory cards or miniature hard 
drives. Most digital cameras also include a screen for viewing the stored images. 
This storage media can contain any digital data, including data unrelated to 
photographs or videos. 

c. Portable media player: A portable media player (or “MP3 Player” or iPod) is a 
handheld digital storage device designed primarily to store and play audio, video, . 


or photographic files. However, a portable media player can:also store other 
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digital data. Some portable media players can use removable storage media. 
Removable storage media include various types of flash memory cards or 
miniature hard drives. This removable storage media can also store any digital 
data, Depending on the model, a portable media player may have the ability to 
store very large amounts of electronic data and may offer additional features such 
as a calendar, contact list, clock, or games. 

d. GPS: A GPS navigation device uses the Global Positioning System to display its 
current location. It often contains records of the locations where it has been, 
Some GPS navigation devices can give a _ driving or walking directions to 
another location. These devices can contain records of the sddiesees or locations 
involved in such fai gation. The Global Positioning System (generally 
abbreviated “GPS”) consists of 24 NAVSTAR satellites orbiting the Earth. Each 
satellite contains an extremely accurate clock. Each satellite tepeatedly transmits 
by radio a mathematical representation of the current time, oonibiied with a. 
special sequence of numbers. These signals are sent by eat, using specifications 
that are publicly available. A GPS antenna on Earth can receive those signals. 
When a GPS antenna receives signals from at least four satellites, a computer 
connected to that antenna can mathematically calculate the antenna’s latitude, 
longitude, and sometimes altitude with a high level of precision. 

e. PDA: A personal digital assistant, or PDA, is a handheld electronic device used 
for storing data (such as names, addresses, appointments, or notes) and utilizing 
computer programs. Some PDAs also function as wireless communication 


devices and are used to access the Internet and send and receive email. PDAs 
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usually include a memory card or other removable storage media for storing data 
and a keyboard and/or touch screen for entering data. Remiovabls storage media 
include various types of flash memory cards or miniature hard drives. This 
removable storage media can store any digital data. Most PDAs run computer 
software, giving them many of the same capabilities as personal computers. For 
example, PDA users can work with word-processing documents, spreadsheets, 
and presentations. PDAs may also include GPS technology for ‘acteccnittng the . 
location of the device. 

f. IP Address: An Internet.Protocol address (or simply “IP address”) is a unique 
numeric address used by computers on the Internet. An IP address is a series of 
four numbers, each in the range 0-255, separated by periods (eg, 121.56.97.178). 
Every computer attached to the Intemet must be assigned an IP address so that 
Internet traffic sent from and sivested to that computer may be directed properly 
from its source - its destination. Most Internet service providers control a range 
of IP addresses, Some computers have static—that is, long-tecm—IP addresses, 
while other computers have dynamic—that is, frequently changed—IP addresses. 

g. Internet: The Internet is a global network of computers and other diedteanie 
devices that communicate with each other. Due to the structure of the Internet, 
connections between devices on the Internet often cross state and international 
borders, even when the devices communicating with each other are in the same 


state. 
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ELECTRONIC STORAGE AND FORENSIC ANALYSIS 


36. As described above and in Attachment B, this application seeks permission to search for 
records that might be found on the premises, in whatever form they are found. One form 
in which the records might be found is data stored on an electronic device. In particular, 
this application seeks permission to seize an Apple iPhone (hereinafter “the Device”), 
which could transmit and store such data. Thus, the warrant ssnilee for would authorize 
the seizure of the Apple iPhone under Rule 41(e)(2)(B). | 

37. Based on my knowledge, training, and experience, I know that diepeonte devices can 
store information for long periods of time, including text messages. ‘Texts messages sent 
or received on a cellular phone can be stored on a cellular phone at little or no cost. Even 
when text messages have been deleted by the user of a cellular onesie text 
messages, or remnants of those deleted text files, can be recovered months after they have 

-been deleted from a cellular phone. This is so because when a user of a cellular phone 
“deletes” a text message, the data contained in that message does not actually disappear; 
rather, that data remains on the cellular phone until it is overwritten with new data. 
Deleted text messages, or remnants of deleted text messages, may reside on the cellular 
phone for long periods of time before they are overwritten. Such data can sometimes be 
recovered with forensic tools. ; 

38. Forensic evidence: As further described in Attachment B, this application seeks 
permission to locate not only electronically stored information that might serve as direct 
evidence of the crimes described on the warrant, but also forensic evidence that 


establishes how the Device was used, the purpose of its use, who used it, and when. 
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There is probable cause to believe that this forensic electronic evidence might be on the 
Device because: | 

a. Data on the storage medium can provide evidence of a file that was once on the 
storage medium but has since been deleted or edited, or of a deleted portion of a 
file (such as a paragraph that has been deleted from a word processing file). 
Virtual memory paging systems can leave traces of information on the storage 
medium that show what tasks and processes were recently active. Web browsers, 
email programs, and chat programs store configuration information on the storage 
medium that can reveal information such as online nicknames and passwords. 
Operating systems can record additional information, such as the attachment of 
peripherals, the attachment of USB flash storage devices or other external storage 
media, and the times the computer was in use. Computer file systems can record 
information about the dates files were created and the sequence in which icy 
were created. | 

b. Forensic evidence on a device can also indicate who has ‘ied or controlled the 
device. This “user attribution” evidence is analogous to the scareli for “indicia of 
occupancy” while executing a search warrant at a residence, ' 

c. A person with soreness familiarity with how an electronic device works may, 
after examining this forensic evidence in its proper context, be able to draw 
conclusions about how electronic devices were used, the purpose of their use, who 
used them, and when. 

d. The process of identifying the exact electronically stored information on a storage 


medium that is necessary to draw an accurate conclusion is a dynamic process. 
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Electronic evidence is not always data that can be merely Pere by a review 
team and passed along to investigators. Whether data stored on a computer is 
evidence may depend on other information stored on the computer and the 
application of knowledge about how a computer behaves. Therefore, contextual 
information necessary to understand other evidence also falls within the scope of 
the warrant. 

e. Further, in finding evidence of how a device was used, the purpose of its use, who 
siaed it, and when, sometimes it is necessary to establish that a particular thing is 
not present on a storage medium. 

f. I know that when an individual uses an electronic device to unlawfully 
communicate and/or retain dlaseitied information, the judvidiels electronic 
device will generally serve both as an instrumentality for committing the crime, © 
and also as a storage medium for evidence of the crime. The'electronic device is 
an instrumentality of the crime because it is used as a means of committing the 
criminal offense. The electronic device is also likely to be a ernie medium for 
evidence of crime. From my training and experience, I believe that an electronic 
device used to commit a crime of this type may contain: data that is evidence of 
how the electronic device was used; data that was sent or received; notes as to 
how the criminal conduct was achieved; records of Internet discussions about the 


crime; and other records that indicate the nature of the offense. 


39. Necessity of seizing or copying entire computers or storage media: In most cases, a 
thorough search of a premises for information that might be stored on storage media often 


requires the seizure of the physical storage media and later off-site review consistent with 
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the warrant. In lieu of removing storage media from the premises, it is sometimes 
possible to make an image copy of storage media. Generally speaking, imaging is the 
taking of a complete electronic picture of the computer’s data, including all hidden 
sectors and deleted files. Either seizure or imaging is often necessary to ensure the 
accuracy and completeness of data eos on the storage media, and to prevent the loss 
of the data either from accidental or intentional destruction. This is true because of the 
following: 

a. The time required for an examination. As noted above, not all evidence takes the 
form of documents and files that can be easily viewed on site. Analyzing 
evidence of how a computer has been used, what it has been used for, and who 
has used it requires considerable time, and taking that much ang on premises 
could be unreasonable. As explained above, because the warrant calls for forensic 
electronic evidence, it is exceedingly likely that it will be necessary to thoroughly 
examine storage media to obtain evidence. Storage media can store a large 
volume of information. Reviewing that information for things described in the 
warrant can take weeks or months, depending on the ‘elutne of data stored, and 
would be impractical and invasive to attempt on-site. 

b. Technical requirements. Computers can be configured in several different ways, 
featuring a variety of different operating systems, application software, and 
configurations. Therefore, searching them sometimes requires tools or knowledge 
that might not be present on the search site. The vast array of computer hardware 
and software available makes it difficult to know before a search what tools or 


knowledge will be required to analyze the system and its data on the premises. 
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However, taking the storage media off-site and reviewing it in a controlled 
environment will allow its examination with the proper tools and knowledge. 

c. Variety of forms of electronic media. Records sought under this warrant could be 
stored ina janes of storage media formats that may require off-site reviewing 
with specialized forensic tools. 

40. Nature of examination: Based on the foregoing, and consistent with Rule 41(e)(2)B), 
the warrant I am applying for would permit the examination of the Device consistent with 
the warrant. Searches and seizures of evidence from computers conimonly requires 
agents to download or copy information from the computer and components, and to seize 
the computer to be processed later by a qualified computer expert in'a laboratory or other 
controlled environment. Searching computer systems for evidence is an exacting 
scientific procedure that is designed to protect the integrity of the evidence and to recover 
hidden, erased, deleted, compressed, password-protected, or encrypted files. The 
examination may require authorities to employ techniques, including but not limited to 
computer-assisted scans of the entire medium, that might expose hy parts of the 
devices to human inspection in order to determine whether it is edions described by the 
warrant. 

41. Based on my training, experience, and research, I know that the Device has capabilities 
that allow it to serve as a wireless telephone, digital camera, portable media player, GPS 
navigation device, and PDA. In my training and experience, examining data stored on 
devices of this type can uncover, among other things, evidence that reveals or suggests 
who possessed or used the device, emails, texts, email addresses used, IP address 


information, and internet browsing history. 
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CONCLUSION 

42. Based upon the foregoing, your affiant submits that sufficient probable cause exists for 
the issuance of a warrant to search SI 
= ie as further described in Attachments A and B; and that the described 
premises contains evidence of a crime relating to: (a) unauthorized removal and retention 
of classified documents and material, in violation of 18 U.S.C. § 1924; (b) unauthorized 
possession and, inter alia, attempted communication and willful conimunication of 
national defense information to someone not entitled to receive it, as well as the willful 
retention of national defense information, in violation of 18 U.S.C. § 793(e); and (c) 


conspiracy to commit the aforementioned crimes, in violation of 18 U.S.C. § 371. 
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REQUEST FOR SEALING 


43, Since this investigation is continuing, disclosure of the search warrant, this affidavit, 
and/or this application and the attachments thereto will jeopardize the progress of the 
investigation. Accordingly, it is respectfully requested that the Court issue an order that 
the search warrant, this affidavit in support of the application for search warrant, the 
application for search warrant, and all attachments thereto be filed under seal until further 


order of this Court. 


Respectfully submitted, 


= J. fa hj 


Special Agent 
Federal Bureau of Investigation 


Sworn to and subscribed before me 


onthis, the 2) __day of April, 2013. 
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ATTACHMENT A 


Property To Be Searched 


This warrant applies to a single family home and adjoining two-car garage owned by 


aa located ot 
MN «This property is further described as Snes 


ES 2s 00: oo 
fo ld The house number {MM is visible as brass numerals on the molding above 


the front entry door. A photograph of the residence is provided below: 
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ATTACHMENT B 


Particular Thing To Be Seized 


Apple iPhone, serial number C28J60GKDTDD, hereinafter “the Device.” — 


Information To Be Seized by the Government 


1. All records or information on the Device that constitute fruits, evidence, and 
instrumentalities of violations of the statutes listed on the warrant, including: 
. All records or information related to any communications between 

> | and Petraeus; . 

. All copes or information related to any comminumieations from December 
2008 to the present, between [ME and any other person or entity 
concerning classified and/or national defense information; 

All records or information, from December 2008 to the piesa related to any 
classified and/or national defense information; ; 

. All records or information, from December 2008 to the present, related to the 
source(s) or potential source(s) of any classified and/or national defense 
information provided to | ae 
All records or information, from December 2008 to the present, related to the 
state of mind of any individuals concerning the communication, disclosure, 
receipt, or ceteeiion of classified and/or national defense indienne 
All records or information relating to knowledge of laws, rules, regulations, 
and/or procedures prohibiting the unauthorized disclosure or retention of 


classified and/or national defense information; 
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g. All records or information related to any communications from June 2012 to 
the present between and any other person concerning ongoing 
law enforcement investigations; 

h. All records or information concerning any email accounts, telephone numbers, 
or other methods of communication used by (RE or Petracus; 

i. Any information recording Bor Petraeus’s schedule or travel 
from December 2008 to the present; 

j. Evidence of user attribution showing who used or owned the Device at the 
time the items described in this warrant were created, edited, or deleted, such 
as logs, phonebooks, address books, contact lists, saved usernames and 
passwords, documents, and browsing history; and 

k. Records evidencing the use of the Internet, including records of Internet 
Protocol addresses used; 

2. As used above, the terms “records” and “information” include all of the foregoing 
items of evidence in whatever form and by whatever means they:may have been 
created or stored, including any form of computer or electronic storage (such as flash 


memory or other media that can store data) and any photo graphic form. 
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AO 93 (Rev. 12/09) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the : 
Western District of North Carolina 


In the Matter of the Search of ) : Cortifod fo ba 2 fue ang 
(Briefly describe the property to be searched ) : . Sct Copy Of the Original 
or identify the person by name and address) ) Case No. 4, " 14 nr | 9 4 2 US. Ceatrict. Cou ; 
Fren on 
The Premises Located at Se oe ee ) . "stk G, ohns, ek 
as described in Affidavit ) trict of 
and Attachment, incorporated herein. ) 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located inthe Western District of North Carolina 


(identify the person or describe the property to be searched and give its location): 
See Attachment A, which is incorporated fully herein. 


The person or property to be searched, described above, is believed to conceal (identify the person or describe the 


property to be seized): 
See Attachment B, which is incorporated fully herein. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 
property. ‘ 


YOU ARE COMMANDED to execute this warrant on or before April 17, 2013 


(not to exceed 14 days) 
& inthe daytime 6:00 a.m, to 10 p.m. C1 at any time in the day or night as I find reasonable cause has been 
established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge 
Robert J. Conrad, Jr. ‘ 

(name) 


C1 I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be 
searched or seized (check the appropriate box) () for days (not to exceed 30). 


1 until, the facts justifying, the later specific'date of 


Date and time issued: i 13 19 BA pa a faba 4 oat 


udge 's signature 


City and state: Charlotte, North Carolina Robert J. Conrad, U.S. District Court Judge 
: Printed name and litle 
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AO 93 (Rey, 12/09) Search and Seizure Warrant (Page 2) 


Case No.; 4, . 4 4 Date and time warrant executed: Copy of warrant and inventory left with: 
Am 


Inventory made in the presence of : : a: 


Inventory of the property taken and name of any person(s) seized: 


I declare under penalty of perjury that this inventory is correct and was returned along with the original 
warrant to the designated judge, 


Executing officer's signature 


Printed name and title 


Case 3:13-mj-00099-DSC *SEALED* Document 6 Filed 12/20/16 Page 2 of 2 


